QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2023-4816

Back to search

CVE-2023-4816

Published: Sep 11, 2023

Modified: Sep 25, 2024

PUBLISHED

CVSS v3.1

6.9

MEDIUM

Description

A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.

VendorProductVersions

Hitachi Energy

Asset Suite 9

affected
9.6.3.11.0 - <= 9.6.3.11.1
affected
9.6.4

Weaknesses (CWE)

CWE-287

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now