// For flags

CVE-2021-40335

Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., link is sent per E-Mail, could perform harmful command on MSM through its web server interface. This issue affects: Hitachi Energy MSM V2.2 and prior versions.

Se presenta una vulnerabilidad en la interfaz web HTTP en la que la interfaz web no comprueba suficientemente si una petición bien formada, válida y coherente fue proporcionada intencionalmente por el usuario que envió la petición. Esto causa una vulnerabilidad de tipo Cross Site Request Forgery (CSRF), que si es explotada podría conllevar a un atacante a obtener acceso no autorizado a la aplicación web y llevar a cabo una operación no deseada en ella sin el conocimiento del usuario legítimo. Un atacante, que logra que un usuario de MSM que ya ha establecido una sesión con la interfaz web de MSM haga clic en un enlace falsificado a la interfaz web de MSM, por ejemplo, el enlace es enviado por correo electrónico, podría llevar a cabo un comando dañino en MSM mediante su interfaz de servidor web. Este problema afecta a: Hitachi Energy MSM versiones V2.2 y versiones anteriores

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-08-31 CVE Reserved
  • 2022-07-25 CVE Published
  • 2024-02-08 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachienergy
Search vendor "Hitachienergy"
 Modular Switchgear Monitoring Firmware
Search vendor "Hitachienergy" for product "Modular Switchgear Monitoring Firmware"
 <= 2.2.0
Search vendor "Hitachienergy" for product "Modular Switchgear Monitoring Firmware" and version " <= 2.2.0"
-
Affected
in Hitachienergy
Search vendor "Hitachienergy"
 Modular Switchgear Monitoring
Search vendor "Hitachienergy" for product "Modular Switchgear Monitoring"
--
Safe