title: Asset Suite Direct Object Reference Access
description: Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
problem types: CWE-284 Improper Access Control
affected:
{
product: Asset Suite
vendor: ABB
versions:
status: affected, version: 9.0 to 9.3
status: affected, version: 9.4 prior to 9.4.2.6
status: affected, version: 9.5 prior to 9.5.3.2
status: affected, version: 9.6.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
]
solutions: The vulnerability is corrected in the following product versions:
Asset Suite 9.4.2.6
Asset Suite 9.5.3.2
Asset Suite 9.6.1