CVE-2021-40335

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., link is sent per E-Mail, could perform harmful command on MSM through its web server interface. This issue affects: Hitachi Energy MSM V2.2 and prior versions.

• CWE-352
• CWE-352

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=LaunchMitigation, Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=LaunchMitigation, Vendor Advisory

Published

Jul 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40329The Authentication API in Ping Identity PingFederate before …9.8
• CVE-2021-4033kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)6.5
• CVE-2021-40330git_connect_git in connect.c in Git before 2.30.1 allows a r…7.5
• CVE-2021-40331An Incorrect Permission Assignment for Critical Resource vul…8.1
• CVE-2021-40333Weak Password Requirements vulnerability in Hitachi Energy F…7.1
• CVE-2021-40334Missing Handler vulnerability in the proprietary management …7.5
• CVE-2021-40336A vulnerability exists in the http web interface where the w…8.8
• CVE-2021-40337Cross-site Scripting (XSS) vulnerability in Hitachi Energy L…5.4
• CVE-2021-40338Hitachi Energy LinkOne product, has a vulnerability due to a…5.3
• CVE-2021-40339Configuration vulnerability in Hitachi Energy LinkOne applic…7.5
• CVE-2021-4034A local privilege escalation vulnerability was found on polk…7.8
• CVE-2021-40340Information Exposure vulnerability in Hitachi Energy LinkOne…7.5