Successful exploitation of these remotely exploitable vulnerabilities, which Hitachi Energy self-reported, could allow an attacker to disclose sensitive information related to eSOMS application configuration.
The following Hitachi Energy products suffer from the vulnerabilities: eSOMS, v6.3.13 and prior.
In one issue, the response messages received from the eSOMS report generation using certain parameter queries with full file path can end up abused for enumerating the local file system structure.
CVE-2023-5514 is the case number for this vulnerability, which has a CVSS v3.1 base score of 5.3.
In addition, the responses for web queries with certain parameters disclose internal path of resources. This information can end up used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications.
CVE-2023-5515 is the case number for this vulnerability, which has a CVSS v3.1 base score of 5.3.
Also, poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and other sensitive information details. The website unintentionally reveals sensitive information including technical details like version info, endpoints, backend server, Internal IP. etc., which could expose additional attack surface containing other vulnerabilities.
CVE-2023-5516 is the case number assigned to this vulnerability, which has a CVSS v3.1 base score of 5.3.
The product sees use mainly in the energy sector, and on a global basis.
No known public exploits target these vulnerabilities. However, an attacker could leverage these low complexity vulnerabilities.
Hitachi Energy recommends updating eSOMS to a fixed version when available.
For more information on this issue, click on the Hitachi Energy eSOMS Security Advisory 8DBD000175.