Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2019-19089

eSOMS: X-Content-Type-Options Header Missing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ABB

Description

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text interpreted as JavaScript.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ABB eSOMS

  • 4.0 to 6.0.3affected

References