ABB eSOMS (Update A)
Successful exploitation of this vulnerability requires an attacker to discover a valid user account, which could be used to gain access to the application without authentication.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-14805US | critical9.8 | — | ||
ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationeSOMS
Users should contact ABB global customer care (GCC) for further guidance if they experience issues with implementing LDAP authentication using only the previously mentioned key values.
- FixedeSOMS
Users running eSOMS Version 6.0.2 should ensure “Unauthenticated Authentication” (anonymous bind) is disabled in the LDAP configuration settings. In the eSOMS web.config file, ensure only the following key values are populated: “LDAP_Path,” “LDAP_User_Search,” and “LDAP_SSL_Enabled.” The remaining LDAP related key values are reserved for non-standard LDAP server configurations and are not normally required.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan