CVE-2021-40338 : Security Advisory and Response

OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product

Understanding CVE-2021-40338

This CVE report highlights a vulnerability in Hitachi Energy's LinkOne product due to a web server misconfiguration that exposes sensitive information.

What is CVE-2021-40338?

Hitachi Energy LinkOne product, versions 3.20 to 3.26, is susceptible to a security flaw that enables debug mode, disclosing the filesystem directory path when errors occur during certain operations.

The Impact of CVE-2021-40338

The vulnerability poses a low severity risk with a CVSS base score of 3.7. It affects confidentiality to a low extent but does not impact availability or integrity.

Technical Details of CVE-2021-40338

This section delves into the specifics of the vulnerability.

Vulnerability Description

The issue stems from a web server misconfiguration in Hitachi Energy LinkOne, allowing attackers to reveal the full path of the filesystem directory under certain conditions.

Affected Systems and Versions

Product: Hitachi Energy LinkOne
Versions Affected: 3.20, 3.22, 3.23, 3.24, 3.25, 3.26

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Network
Privileges Required: None
User Interaction: None
Scope: Unchanged

Mitigation and Prevention

For organizations and users, taking immediate and long-term steps is crucial in addressing and preventing such vulnerabilities.

Immediate Steps to Take

Apply security patches or updates promptly to LinkOne v3.27.

Long-Term Security Practices

Regularly review and update server configurations.
Conduct periodic security audits and tests on web servers.

Patching and Updates

Implement timely security patches provided by Hitachi Energy for LinkOne.