CVE-2021-40338 - OpenCVE

Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hitachi	Linkone

Configuration 1 [-]

OR	cpe:2.3:a:hitachi:linkone:3.20:::::::*
	cpe:2.3:a:hitachi:linkone:3.22:::::::*
	cpe:2.3:a:hitachi:linkone:3.23:::::::*
	cpe:2.3:a:hitachi:linkone:3.24:::::::*
	cpe:2.3:a:hitachi:linkone:3.25:::::::*
	cpe:2.3:a:hitachi:linkone:3.26:::::::*

No data.

References

Link	Providers
https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch

History

No history.

MITRE

Status: PUBLISHED

Assigner: Hitachi Energy

Published: 2022-01-28T19:09:55.954957Z

Updated: 2024-09-16T22:40:31.929Z

Reserved: 2021-08-31T00:00:00

Link: CVE-2021-40338

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-01-28T20:15:11.190

Modified: 2022-08-09T00:50:27.057

Link: CVE-2021-40338

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "credits": [{"lang": "en", "value": "Hitachi Energy thanks the following for working with us to help protect our customers: Compa\u00f1\u00eda Minera Do\u00f1a In\u00e9s de Collahuasi SCM."}], "datePublic": "2021-12-23T00:00:00", "descriptions": [{"lang": "en", "value": "Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-01-28T19:09:55", "orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}], "solutions": [{"lang": "en", "value": "For each version, apply security patch or update to LinkOne v3.27"}], "source": {"discovery": "USER"}, "title": "OWASP Related Vulnerabilities in Hitachi Energy\u2019s LinkOne Product", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@hitachienergy.com", "DATE_PUBLIC": "2021-12-23T17:00:00.000Z", "ID": "CVE-2021-40338", "STATE": "PUBLIC", "TITLE": "OWASP Related Vulnerabilities in Hitachi Energy\u2019s LinkOne Product"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Hitachi Energy thanks the following for working with us to help protect our customers: Compa\u00f1\u00eda Minera Do\u00f1a In\u00e9s de Collahuasi SCM."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch", "refsource": "CONFIRM", "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}]}, "solution": [{"lang": "en", "value": "For each version, apply security patch or update to LinkOne v3.27"}], "source": {"discovery": "USER"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:27:31.918Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}]}]}, "cveMetadata": {"assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "assignerShortName": "Hitachi Energy", "cveId": "CVE-2021-40338", "datePublished": "2022-01-28T19:09:55.954957Z", "dateReserved": "2021-08-31T00:00:00", "dateUpdated": "2024-09-16T22:40:31.929Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:linkone:3.20:*:*:*:*:*:*:*", "matchCriteriaId": "2A16D152-D43D-4142-9233-537641563DED", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.22:*:*:*:*:*:*:*", "matchCriteriaId": "5CAD5EC3-8E95-4B92-92F8-D9D6E869736A", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.23:*:*:*:*:*:*:*", "matchCriteriaId": "74EFFBDC-AC66-41B4-B2DA-B3800FADCDDD", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.24:*:*:*:*:*:*:*", "matchCriteriaId": "41AC7B8C-4C18-4E79-96FA-E52FF81377E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.25:*:*:*:*:*:*:*", "matchCriteriaId": "8AA20569-CB37-404F-B459-2C5CD4C3C44D", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.26:*:*:*:*:*:*:*", "matchCriteriaId": "B91F1986-443B-4802-8D20-FFD8B7FE7322", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26."}, {"lang": "es", "value": "El producto Hitachi Energy LinkOne, presenta una vulnerabilidad debida a una configuraci\u00f3n err\u00f3nea del servidor web, que habilita el modo de depuraci\u00f3n y revela la ruta completa del directorio del sistema de archivos cuando un atacante genera errores durante una operaci\u00f3n de consulta. Este problema afecta a: Hitachi Energy LinkOne versiones 3.20; 3.22; 3.23; 3.24; 3.25; 3.26"}], "id": "CVE-2021-40338", "lastModified": "2022-08-09T00:50:27.057", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cybersecurity@hitachienergy.com", "type": "Secondary"}]}, "published": "2022-01-28T20:15:11.190", "references": [{"source": "cybersecurity@hitachienergy.com", "tags": ["Vendor Advisory"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}], "sourceIdentifier": "cybersecurity@hitachienergy.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "nvd@nist.gov", "type": "Primary"}]}