CVE-2023-2876

Session cookie exposure for client side script

State: Published
Severity: 3.1 Low
Published: Jun 13, 2023
Updated: Jan 3, 2025
Reserved: May 24, 2023

Description

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N	ABB

Weaknesses

CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag

Affected Products

Product	Versions
REX640 PCL1ABB	1.0;0 to before 1.0.8Affected
REX640 PCL2ABB	1.0;0 to before 1.1.4Affected
REX640 PCL3ABB	1.0;0 to before 1.2.1Affected

References

https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423&LanguageCode=en&DocumentPartId=&Action=Launch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.