ABB eSOMS (Update A)
Successful exploitation of this vulnerability requires an attacker to discover a valid user account, which could be used to gain access to the application without authentication.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-14805US | critical9.8 | — | ||
ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationeSOMS
Users should contact ABB global customer care (GCC) for further guidance if they experience issues with implementing LDAP authentication using only the previously mentioned key values.
- BehobeneSOMS
Users running eSOMS Version 6.0.2 should ensure “Unauthenticated Authentication” (anonymous bind) is disabled in the LDAP configuration settings. In the eSOMS web.config file, ensure only the following key values are populated: “LDAP_Path,” “LDAP_User_Search,” and “LDAP_SSL_Enabled.” The remaining LDAP related key values are reserved for non-standard LDAP server configurations and are not normally required.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan