CVE-2018-19616

Опубликовано: 26 дек. 2018

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.

Ссылки

http://packetstormsecurity.com/files/150619/Rockwell-Automation-Allen-Bradley-PowerMonitor-1000-Authentication-Bypass.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/106333
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/108538
https://ics-cert.us-cert.gov/advisories/ICSA-19-050-04
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45937/
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/150619/Rockwell-Automation-Allen-Bradley-PowerMonitor-1000-Authentication-Bypass.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/106333
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/108538
https://ics-cert.us-cert.gov/advisories/ICSA-19-050-04
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45937/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:rockwellautomation:powermonitor_1000_firmware:1408-em3a-ent_b:*:*:*:*:*:*:*

cpe:2.3:h:rockwellautomation:powermonitor_1000:-:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03243

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-cv4m-92cm-6ff9