Details of VAR-202004-0859

ID

VAR-202004-0859

CVE

CVE-2019-19094

TITLE

ABB eSOMS SQL injection vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-17170 // CNNVD: CNNVD-202003-800

DESCRIPTION

Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database. ABB eSOMS To SQL An injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. ABB eSOMS is a set of factory operation management system of Swiss ABB company. The vulnerability stems from the lack of verification of external input SQL statements by database-based applications. Attackers can use this vulnerability to execute illegal SQL commands

Trust: 2.61

sources: NVD: CVE-2019-19094 // JVNDB: JVNDB-2019-015259 // CNVD: CNVD-2020-17170 // IVD: 70ea6001-ae3e-4ce3-ab25-a33d786d1379 // IVD: 4613df6f-8ac8-42da-9f71-55237dee5239 // VULHUB: VHN-151506

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.0

sources: IVD: 70ea6001-ae3e-4ce3-ab25-a33d786d1379 // IVD: 4613df6f-8ac8-42da-9f71-55237dee5239 // CNVD: CNVD-2020-17170

AFFECTED PRODUCTS

vendor:	hitachienergy	model:	esoms	scope:	gte	version:	3.9	Trust: 1.0
vendor:	hitachienergy	model:	esoms	scope:	lte	version:	6.0.3	Trust: 1.0
vendor:	abb	model:	esoms	scope:	eq	version:	3.9 から 6.0.3	Trust: 0.8
vendor:	abb	model:	esoms	scope:	lte	version:	<=6.0.3	Trust: 0.6
vendor:	esoms	model:	-	scope:	eq	version:	*	Trust: 0.4

sources: IVD: 70ea6001-ae3e-4ce3-ab25-a33d786d1379 // IVD: 4613df6f-8ac8-42da-9f71-55237dee5239 // CNVD: CNVD-2020-17170 // JVNDB: JVNDB-2019-015259 // NVD: CVE-2019-19094

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19094
value:	HIGH
Trust: 1.0
cybersecurity@ch.abb.com:	CVE-2019-19094
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2019-015259
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-17170
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202003-800
value:	HIGH
Trust: 0.6
IVD:	70ea6001-ae3e-4ce3-ab25-a33d786d1379
value:	HIGH
Trust: 0.2
IVD:	4613df6f-8ac8-42da-9f71-55237dee5239
value:	HIGH
Trust: 0.2
VULHUB:	VHN-151506
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-19094
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-015259
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-17170
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	70ea6001-ae3e-4ce3-ab25-a33d786d1379
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	4613df6f-8ac8-42da-9f71-55237dee5239
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-151506
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-19094
baseSeverity:	HIGH
baseScore:	7.6
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	4.7
version:	3.1
Trust: 2.0
NVD:	JVNDB-2019-015259
baseSeverity:	HIGH
baseScore:	7.6
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: 70ea6001-ae3e-4ce3-ab25-a33d786d1379 // IVD: 4613df6f-8ac8-42da-9f71-55237dee5239 // CNVD: CNVD-2020-17170 // VULHUB: VHN-151506 // JVNDB: JVNDB-2019-015259 // CNNVD: CNNVD-202003-800 // NVD: CVE-2019-19094 // NVD: CVE-2019-19094

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.9

sources: VULHUB: VHN-151506 // JVNDB: JVNDB-2019-015259 // NVD: CVE-2019-19094

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-800

TYPE

SQL injection

Trust: 1.0

sources: IVD: 70ea6001-ae3e-4ce3-ab25-a33d786d1379 // IVD: 4613df6f-8ac8-42da-9f71-55237dee5239 // CNNVD: CNNVD-202003-800

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015259

PATCH

title:	ABBVU-PGGA-2018035	url:	https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=Launch	Trust: 0.8
title:	Patch for ABB eSOMS SQL injection vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/208957	Trust: 0.6
title:	ABB eSOMS SQL Repair measures for injecting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=112316	Trust: 0.6

sources: CNVD: CNVD-2020-17170 // JVNDB: JVNDB-2019-015259 // CNNVD: CNNVD-202003-800

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19094	Trust: 3.5
db:	ICS CERT	id:	ICSA-20-072-01	Trust: 2.0
db:	CNVD	id:	CNVD-2020-17170	Trust: 1.1
db:	CNNVD	id:	CNNVD-202003-800	Trust: 1.1
db:	JVNDB	id:	JVNDB-2019-015259	Trust: 0.8
db:	AUSCERT	id:	ESB-2020.0929	Trust: 0.6
db:	IVD	id:	70EA6001-AE3E-4CE3-AB25-A33D786D1379	Trust: 0.2
db:	IVD	id:	4613DF6F-8AC8-42DA-9F71-55237DEE5239	Trust: 0.2
db:	VULHUB	id:	VHN-151506	Trust: 0.1

REFERENCES

url:	https://www.us-cert.gov/ics/advisories/icsa-20-072-01	Trust: 2.0
url:	https://search.abb.com/library/download.aspx?documentid=9akk107492a9964&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19094	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-19094	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.0929/	Trust: 0.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107492a9964&languagecode=en&documentpartid=&action=launch	Trust: 0.1

sources: CNVD: CNVD-2020-17170 // VULHUB: VHN-151506 // JVNDB: JVNDB-2019-015259 // CNNVD: CNNVD-202003-800 // NVD: CVE-2019-19094

SOURCES

db:	IVD	id:	70ea6001-ae3e-4ce3-ab25-a33d786d1379
db:	IVD	id:	4613df6f-8ac8-42da-9f71-55237dee5239
db:	CNVD	id:	CNVD-2020-17170
db:	VULHUB	id:	VHN-151506
db:	JVNDB	id:	JVNDB-2019-015259
db:	CNNVD	id:	CNNVD-202003-800
db:	NVD	id:	CVE-2019-19094

LAST UPDATE DATE

2024-11-23T21:35:58.677000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-17170	date:	2020-03-15T00:00:00
db:	VULHUB	id:	VHN-151506	date:	2020-04-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-015259	date:	2020-06-24T00:00:00
db:	CNNVD	id:	CNNVD-202003-800	date:	2020-04-07T00:00:00
db:	NVD	id:	CVE-2019-19094	date:	2024-11-21T04:34:11.393

SOURCES RELEASE DATE

db:	IVD	id:	70ea6001-ae3e-4ce3-ab25-a33d786d1379	date:	2020-03-12T00:00:00
db:	IVD	id:	4613df6f-8ac8-42da-9f71-55237dee5239	date:	2020-03-12T00:00:00
db:	CNVD	id:	CNVD-2020-17170	date:	2020-03-15T00:00:00
db:	VULHUB	id:	VHN-151506	date:	2020-04-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-015259	date:	2020-04-21T00:00:00
db:	CNNVD	id:	CNNVD-202003-800	date:	2020-03-12T00:00:00
db:	NVD	id:	CVE-2019-19094	date:	2020-04-02T20:15:15.017