CVE-2021-35530
User authentication bypass in TXpert Hub CoreTec 4
- State
- Published
- Severity
- 6.0 Medium
- Published
- Jun 7, 2022
- Updated
- Sep 16, 2024
- Reserved
- Jun 28, 2021
Description
A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.0 Medium | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L | Hitachi Energy |
Weaknesses
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected Products
| Product | Versions |
|---|---|
TXpert Hub CoreTec 4 versionHitachi Energy |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.