// For flags

CVE-2021-40336

HTTP Response Splitting in Hitachi Energy’s MSM Product

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.

Se presenta una vulnerabilidad en la interfaz web http en la que ésta no comprueba los datos de un encabezado HTTP. Esto causa una posible división de la respuesta HTTP, que si es explotada podría conllevar a un atacante a canalizar código dañino en el navegador web del usuario, como por ejemplo robar las cookies de sesión. Así, un atacante que consiga que un usuario de MSM que ya ha establecido una sesión en la interfaz web de MSM haga clic en un enlace falsificado a la interfaz web de MSM, por ejemplo, el enlace es enviado por correo electrónico, podría engañar al usuario para que descargue software malicioso en su ordenador. Este problema afecta a: Hitachi Energy MSM versiones V2.2 y versiones anteriores

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-08-31 CVE Reserved
  • 2022-07-25 CVE Published
  • 2024-02-08 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachienergy
Search vendor "Hitachienergy"
 Modular Switchgear Monitoring Firmware
Search vendor "Hitachienergy" for product "Modular Switchgear Monitoring Firmware"
 <= 2.2.0
Search vendor "Hitachienergy" for product "Modular Switchgear Monitoring Firmware" and version " <= 2.2.0"
-
Affected
in Hitachienergy
Search vendor "Hitachienergy"
 Modular Switchgear Monitoring
Search vendor "Hitachienergy" for product "Modular Switchgear Monitoring"
--
Safe