CVE-2019-19090 : What You Need to Know

ABB eSOMS versions 4.0 to 6.0.2 are vulnerable due to the absence of the Secure Flag in the HTTP response header, potentially exposing cookie information to eavesdropping.

Understanding CVE-2019-19090

This CVE involves the lack of the Secure Flag in the HTTP response header of ABB eSOMS versions 4.0 to 6.0.2, leading to a security vulnerability.

What is CVE-2019-19090?

The CVE-2019-19090 vulnerability pertains to ABB eSOMS versions 4.0 to 6.0.2, where the Secure Flag is not set in the HTTP response header, allowing unencrypted connections to potentially access cookie information, making it susceptible to eavesdropping.

The Impact of CVE-2019-19090

CVSS Base Score: 3.5 (Low)
Attack Vector: Network
Attack Complexity: Low
User Interaction: Required
Confidentiality Impact: Low
Integrity Impact: None
Privileges Required: Low
Scope: Unchanged
Availability Impact: None

Technical Details of CVE-2019-19090

This section provides detailed technical information about the CVE-2019-19090 vulnerability.

Vulnerability Description

The vulnerability arises from the absence of the Secure Flag in the HTTP response header of ABB eSOMS versions 4.0 to 6.0.2, allowing potential access to cookie information over unencrypted connections.

Affected Systems and Versions

Affected Product: eSOMS
Vendor: ABB
Affected Versions: 4.0 to 6.0.2

Exploitation Mechanism

The vulnerability can be exploited by intercepting unencrypted connections to access sensitive cookie information, posing a risk of eavesdropping.

Mitigation and Prevention

To address CVE-2019-19090, follow these mitigation strategies:

Immediate Steps to Take

Implement HTTPS to encrypt communication and protect sensitive data.
Regularly monitor network traffic for any unauthorized access attempts.
Educate users on secure browsing practices to minimize risks.

Long-Term Security Practices

Conduct regular security audits and vulnerability assessments.
Keep software and systems up to date with the latest security patches.

Patching and Updates

Apply patches provided by ABB for eSOMS versions 4.0 to 6.0.2 to ensure the Secure Flag is properly set in the HTTP response header.