CVE-2021-27414

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-27414
An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials.

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01 Mitigation Third Party Advisory US Government Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:hitachienergy:ellipse_enterprise_asset_management:*:*:*:*:*:*:*:*
History

16 May 2023, 20:16

Type Values Removed Values Added
CPE cpe:2.3:a:abb:ellipse_enterprise_asset_management:*:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:ellipse_enterprise_asset_management:*:*:*:*:*:*:*:*
First Time Hitachienergy ellipse Enterprise Asset Management
Hitachienergy
Information

Published : 2022-03-11 18:15

Updated : 2023-05-16 20:16

NVD link : CVE-2021-27414

Mitre link : CVE-2021-27414

JSON object : View

Products Affected

hitachienergy

  • ellipse_enterprise_asset_management
CWE
CWE-1021

Improper Restriction of Rendered UI Layers or Frames