CVE-2024-11317

🗓️ 05 Dec 2024 12:36:27Reported by ABBType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

Session Fixation vuln. in ABB ASPECT, NEXUS, MATRIX v3.08.0

Reporter	Title	Published	Views	Family All 14
zdt	ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability	11 Feb 202500:00	–	zdt
BDU FSTEC	The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series systems is related to improper session management. This vulnerability allows attackers to intercept user sessions and gain increased privileges.	6 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-11317	5 Dec 202412:52	–	circl
CNNVD	ABB ASPECT 安全漏洞	5 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-11317 PHP Session Fixation	5 Dec 202412:36	–	cvelist
Exploit DB	ABB Cylon Aspect 3.08.02 - PHP Session Fixation	11 Apr 202500:00	–	exploitdb
EUVD	EUVD-2024-34093	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in ABB ASPECT, NEXUS Series and MATRIX Series	6 Dec 202411:49	–	ncsc
NVD	CVE-2024-11317	5 Dec 202413:15	–	nvd
OSV	CVE-2024-11317	5 Dec 202413:15	–	osv

NVD

Node

AND

abb aspect-ent-2_firmwareRange<3.08.03

abb aspect-ent-2Match-

Node

AND

abb aspect-ent-256_firmwareRange<3.08.03

abb aspect-ent-256Match-

Node

AND

abb aspect-ent-96_firmwareRange<3.08.03

abb aspect-ent-96Match-

Node

AND

abb nexus-2128_firmwareRange<3.08.03

abb nexus-2128Match-

Node

AND

abb nexus-2128-a_firmwareRange<3.08.03

abb nexus-2128-aMatch-

Node

AND

abb nexus-2128-f_firmwareRange<3.08.03

abb nexus-2128-fMatch-

Node

AND

abb nexus-2128-g_firmwareRange<3.08.03

abb nexus-2128-gMatch-

Node

AND

abb nexus-264_firmwareRange<3.08.03

abb nexus-264Match-

Node

AND

abb nexus-264-a_firmwareRange<3.08.03

abb nexus-264-aMatch-

Node

AND

abb nexus-264-g_firmwareRange<3.08.03

abb nexus-264-gMatch-

Node

AND

abb nexus-3-2128_firmwareRange<3.08.03

abb nexus-3-2128Match-

Node

AND

abb aspect-ent-12_firmwareRange<3.08.03

abb aspect-ent-12Match-

Node

AND

abb nexus-264-f_firmwareRange<3.08.03

abb nexus-264-fMatch-

Node

AND

abb nexus-3-264_firmwareRange<3.08.03

abb nexus-3-264Match-

Node

AND

abb matrix-11_firmwareRange<3.08.03

abb matrix-11Match-

Node

AND

abb matrix-216_firmwareRange<3.08.03

abb matrix-216Match-

Node

AND

abb matrix-232_firmwareRange<3.08.03

abb matrix-232Match-

Node

AND

abb matrix-264_firmwareRange<3.08.03

abb matrix-264Match-

Node

AND

abb matrix-296_firmwareRange<3.08.03

abb matrix-296Match-

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "ASPECT-Enterprise",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "NEXUS Series",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MATRIX Series",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "initial",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
search	www.search.abb.com/library/Download.aspx

Parameter	Position	Path	Description	CWE
application	query param	192.168.73.31/jsonProxy.php	Session fixation via jsonProxy.php with unauthenticated reflected XSS; attacker can set a predefined PHPSESSID and inject crafted request to force fixated session	CWE-384
query	query param	192.168.73.31/jsonProxy.php	Session fixation via jsonProxy.php with unauthenticated reflected XSS; attacker can set a predefined PHPSESSID and inject crafted request to force fixated session	CWE-384
phpsessid	query param	192.168.73.31/jsonProxy.php	Session fixation via jsonProxy.php with unauthenticated reflected XSS; attacker can set a predefined PHPSESSID and inject crafted request to force fixated session	CWE-384

17 Jun 2026 06:57Current

9.6High risk

Vulners AI Score9.6

CVSS 3.110

CVSS 49.3

EPSS0.00436

SSVC

CWE-384