CVE-2024-11317 | ByteOS Network

Vulnerability Details :

CVE-2024-11317

Assigner-ABB

Assigner Org ID-2b718523-d88f-4f37-9bbd-300c20644bf9

Published At-05 Dec, 2024 | 12:36

Updated At-05 Dec, 2024 | 18:49

PHP Session Fixation

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ABB

Assigner Org ID:2b718523-d88f-4f37-9bbd-300c20644bf9

Published At:05 Dec, 2024 | 12:36

Updated At:05 Dec, 2024 | 18:49

▼CVE Numbering Authority (CNA)

PHP Session Fixation

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

Affected Products

Vendor

Product

ASPECT-Enterprise

Platforms

Linux

Default Status

unaffected

Versions

Affected

From 0 through 3.08.02 (custom)

Vendor

Product

Platforms

Linux

Default Status

unaffected

Versions

Affected

From 0 through 3.08.02 (custom)

Vendor

Product

Platforms

Linux

Default Status

unaffected

Versions

Affected

From initial through 3.08.02 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-384	CWE-384 Session Fixation

Type: CWE

CWE ID: CWE-384

Description: CWE-384 Session Fixation

Metrics

Version	Base score	Base severity	Vector
3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0	9.3	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Version: 3.1

Base score: 10.0

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Version: 4.0

Base score: 9.3

Base severity: CRITICAL

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Credits

finder

ABB likes to thank Gjoko Krstikj, Zero Science Lab, for reporting the vulnerabilities in responsible disclosure

References

Hyperlink	Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch	N/A

Hyperlink: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Vendor

Product

aspect_enterprise

CPEs

cpe:2.3:a:abb:aspect_enterprise:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 0 through 3.08.01 (custom)

Vendor

Product

CPEs

cpe:2.3:a:abb:nexus_series:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 0 through 3.08.01 (custom)

Vendor

Product

CPEs

cpe:2.3:a:abb:matrix_series:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 0 through 3.08.01 (custom)

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:cybersecurity@ch.abb.com

Published At:05 Dec, 2024 | 13:15

Updated At:10 Apr, 2025 | 18:15

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	9.3	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Secondary	3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Primary	3.1	10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Type: Secondary

Version: 4.0

Base score: 9.3

Base severity: CRITICAL

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Secondary

Version: 3.1

Base score: 10.0

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Type: Primary

Version: 3.1

Base score: 10.0

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CPE Matches

>>aspect-ent-2_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:aspect-ent-2_firmware:*:*:*:*:*:*:*:*

>>aspect-ent-2>>-

cpe:2.3:h:abb:aspect-ent-2:-:*:*:*:*:*:*:*

>>aspect-ent-256_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:aspect-ent-256_firmware:*:*:*:*:*:*:*:*

>>aspect-ent-256>>-

cpe:2.3:h:abb:aspect-ent-256:-:*:*:*:*:*:*:*

>>aspect-ent-96_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:aspect-ent-96_firmware:*:*:*:*:*:*:*:*

>>aspect-ent-96>>-

cpe:2.3:h:abb:aspect-ent-96:-:*:*:*:*:*:*:*

>>nexus-2128_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-2128_firmware:*:*:*:*:*:*:*:*

>>nexus-2128>>-

cpe:2.3:h:abb:nexus-2128:-:*:*:*:*:*:*:*

>>nexus-2128-a_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-2128-a_firmware:*:*:*:*:*:*:*:*

>>nexus-2128-a>>-

cpe:2.3:h:abb:nexus-2128-a:-:*:*:*:*:*:*:*

>>nexus-2128-f_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-2128-f_firmware:*:*:*:*:*:*:*:*

>>nexus-2128-f>>-

cpe:2.3:h:abb:nexus-2128-f:-:*:*:*:*:*:*:*

>>nexus-2128-g_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-2128-g_firmware:*:*:*:*:*:*:*:*

>>nexus-2128-g>>-

cpe:2.3:h:abb:nexus-2128-g:-:*:*:*:*:*:*:*

>>nexus-264_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-264_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:nexus-264:-:*:*:*:*:*:*:*

>>nexus-264-a_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-264-a_firmware:*:*:*:*:*:*:*:*

>>nexus-264-a>>-

cpe:2.3:h:abb:nexus-264-a:-:*:*:*:*:*:*:*

>>nexus-264-g_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-264-g_firmware:*:*:*:*:*:*:*:*

>>nexus-264-g>>-

cpe:2.3:h:abb:nexus-264-g:-:*:*:*:*:*:*:*

>>nexus-3-2128_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-3-2128_firmware:*:*:*:*:*:*:*:*

>>nexus-3-2128>>-

cpe:2.3:h:abb:nexus-3-2128:-:*:*:*:*:*:*:*

>>aspect-ent-12_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:aspect-ent-12_firmware:*:*:*:*:*:*:*:*

>>aspect-ent-12>>-

cpe:2.3:h:abb:aspect-ent-12:-:*:*:*:*:*:*:*

>>nexus-264-f_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-264-f_firmware:*:*:*:*:*:*:*:*

>>nexus-264-f>>-

cpe:2.3:h:abb:nexus-264-f:-:*:*:*:*:*:*:*

>>nexus-3-264_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:nexus-3-264_firmware:*:*:*:*:*:*:*:*

>>nexus-3-264>>-

cpe:2.3:h:abb:nexus-3-264:-:*:*:*:*:*:*:*

>>matrix-11_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:matrix-11_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:matrix-11:-:*:*:*:*:*:*:*

>>matrix-216_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:matrix-216_firmware:*:*:*:*:*:*:*:*

>>matrix-216>>-

cpe:2.3:h:abb:matrix-216:-:*:*:*:*:*:*:*

>>matrix-232_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:matrix-232_firmware:*:*:*:*:*:*:*:*

>>matrix-232>>-

cpe:2.3:h:abb:matrix-232:-:*:*:*:*:*:*:*

>>matrix-264_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:matrix-264_firmware:*:*:*:*:*:*:*:*

>>matrix-264>>-

cpe:2.3:h:abb:matrix-264:-:*:*:*:*:*:*:*

>>matrix-296_firmware>>Versions before 3.08.03(exclusive)

cpe:2.3:o:abb:matrix-296_firmware:*:*:*:*:*:*:*:*

>>matrix-296>>-

cpe:2.3:h:abb:matrix-296:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-384	Primary	cybersecurity@ch.abb.com
CWE-384	Primary	nvd@nist.gov

CWE ID: CWE-384

Type: Primary

Source: cybersecurity@ch.abb.com

CWE ID: CWE-384

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch	cybersecurity@ch.abb.com	Vendor Advisory

Hyperlink: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch

Source: cybersecurity@ch.abb.com

Resource:

Vendor Advisory