VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 2, 2020· Updated Aug 5, 2024

eSOMS: X-Content-Type-Options Header Missing

CVE-2019-19089

Description

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text interpreted as JavaScript.

Affected products

2
  • Hitachi/eSOMSllm-fuzzy
    Range: >=4.0, <=6.0.3
  • ABB/eSOMSv5
    Range: 4.0 to 6.0.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.