Lucene search

Hitachi EnergyCVELIST:CVE-2023-5516

HistoryNov 01, 2023 - 2:54 a.m.

CVE-2023-5516

2023-11-0102:54:21

CWE-200

Hitachi Energy

www.cve.org

web requests

unhandled errors

sensitive information

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing
information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version Info, endpoints,
backend server, Internal IP. etc., which can potentially expose additional attack surface containing other interesting vulnerabilities.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "eSOMS",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "lessThanOrEqual": "6.3.13",
        "status": "affected",
        "version": "6.0",
        "versionType": "custom"
      }
    ]
  }
]

References

publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Related for CVELIST:CVE-2023-5516