ABB eSOMS X-XSS-Protection not enabled

Published 6 y ago 2020-04-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.8%

percentile 57%

Public exploits

none known

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.

Exploit prediction (EPSS)

0.79% probability of exploitation in the next 30 days, higher than 57% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	6.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N`
CNA	3.1	6.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N`
NVD	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:N/I:P/A:N`

Affected products

ABB eSOMS

Classification

Weakness

CWE-16 Configuration
CWE-79 Improper Neutralization of Input During Web Page Generation

References

search.abb.com /library/Download.aspx?DocumentID=9AKK107492A9964&LanguageCode=en&DocumentPartId=&Action=L · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2019-19002
NVD: CVE-2019-19002

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.