CVE-2021-40336

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.

• CWE-113
• CWE-74

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory

Published

Jul 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4033kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)6.5
• CVE-2021-40330git_connect_git in connect.c in Git before 2.30.1 allows a r…7.5
• CVE-2021-40331An Incorrect Permission Assignment for Critical Resource vul…8.1
• CVE-2021-40333Weak Password Requirements vulnerability in Hitachi Energy F…7.1
• CVE-2021-40334Missing Handler vulnerability in the proprietary management …7.5
• CVE-2021-40335A vulnerability exists in the HTTP web interface where the w…8.8
• CVE-2021-40337Cross-site Scripting (XSS) vulnerability in Hitachi Energy L…5.4
• CVE-2021-40338Hitachi Energy LinkOne product, has a vulnerability due to a…5.3
• CVE-2021-40339Configuration vulnerability in Hitachi Energy LinkOne applic…7.5
• CVE-2021-4034A local privilege escalation vulnerability was found on polk…7.8
• CVE-2021-40340Information Exposure vulnerability in Hitachi Energy LinkOne…7.5
• CVE-2021-40341DES cipher, which has inadequate encryption strength, is use…5.5