CVE-2021-40339 - OpenCVE

Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hitachi	Linkone

Configuration 1 [-]

OR	cpe:2.3:a:hitachi:linkone:3.20:::::::*
	cpe:2.3:a:hitachi:linkone:3.22:::::::*
	cpe:2.3:a:hitachi:linkone:3.23:::::::*
	cpe:2.3:a:hitachi:linkone:3.24:::::::*
	cpe:2.3:a:hitachi:linkone:3.25:::::::*
	cpe:2.3:a:hitachi:linkone:3.26:::::::*

No data.

References

Link	Providers
https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch

History

No history.

MITRE

Status: PUBLISHED

Assigner: Hitachi Energy

Published: 2022-01-28T19:09:56.663744Z

Updated: 2024-09-17T01:51:52.071Z

Reserved: 2021-08-31T00:00:00

Link: CVE-2021-40339

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-01-28T20:15:11.253

Modified: 2022-02-03T17:33:22.717

Link: CVE-2021-40339

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "credits": [{"lang": "en", "value": "Hitachi Energy thanks the following for working with us to help protect our customers: Compa\u00f1\u00eda Minera Do\u00f1a In\u00e9s de Collahuasi SCM."}], "datePublic": "2021-12-23T00:00:00", "descriptions": [{"lang": "en", "value": "Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-01-28T19:09:56", "orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}], "solutions": [{"lang": "en", "value": "For each version, apply security patch or update to LinkOne v3.27"}], "source": {"discovery": "USER"}, "title": "OWASP Related Vulnerabilities in Hitachi Energy\u2019s LinkOne Product", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@hitachienergy.com", "DATE_PUBLIC": "2021-12-23T17:00:00.000Z", "ID": "CVE-2021-40339", "STATE": "PUBLIC", "TITLE": "OWASP Related Vulnerabilities in Hitachi Energy\u2019s LinkOne Product"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Hitachi Energy thanks the following for working with us to help protect our customers: Compa\u00f1\u00eda Minera Do\u00f1a In\u00e9s de Collahuasi SCM."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch", "refsource": "CONFIRM", "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}]}, "solution": [{"lang": "en", "value": "For each version, apply security patch or update to LinkOne v3.27"}], "source": {"discovery": "USER"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:27:31.943Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}]}]}, "cveMetadata": {"assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "assignerShortName": "Hitachi Energy", "cveId": "CVE-2021-40339", "datePublished": "2022-01-28T19:09:56.663744Z", "dateReserved": "2021-08-31T00:00:00", "dateUpdated": "2024-09-17T01:51:52.071Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hitachi:linkone:3.20:*:*:*:*:*:*:*", "matchCriteriaId": "2A16D152-D43D-4142-9233-537641563DED", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.22:*:*:*:*:*:*:*", "matchCriteriaId": "5CAD5EC3-8E95-4B92-92F8-D9D6E869736A", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.23:*:*:*:*:*:*:*", "matchCriteriaId": "74EFFBDC-AC66-41B4-B2DA-B3800FADCDDD", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.24:*:*:*:*:*:*:*", "matchCriteriaId": "41AC7B8C-4C18-4E79-96FA-E52FF81377E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.25:*:*:*:*:*:*:*", "matchCriteriaId": "8AA20569-CB37-404F-B459-2C5CD4C3C44D", "vulnerable": true}, {"criteria": "cpe:2.3:a:hitachi:linkone:3.26:*:*:*:*:*:*:*", "matchCriteriaId": "B91F1986-443B-4802-8D20-FFD8B7FE7322", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26."}, {"lang": "es", "value": "Una vulnerabilidad de configuraci\u00f3n en la aplicaci\u00f3n Hitachi Energy LinkOne debido a una falta de encabezados HTTP, permite a un atacante que consiga explotar esta vulnerabilidad recuperar informaci\u00f3n confidencial. Este problema afecta a: Hitachi Energy LinkOne versiones 3.20; 3.22; 3.23; 3.24; 3.25; 3.26"}], "id": "CVE-2021-40339", "lastModified": "2022-02-03T17:33:22.717", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cybersecurity@hitachienergy.com", "type": "Secondary"}]}, "published": "2022-01-28T20:15:11.253", "references": [{"source": "cybersecurity@hitachienergy.com", "tags": ["Vendor Advisory"], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch"}], "sourceIdentifier": "cybersecurity@hitachienergy.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}