An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass
Existe una vulnerabilidad de omisión de autenticación en las versiones 1.2.1 y anteriores del software de U.motion Builder de Schneider Electric en la que el sistema contiene una sesión válida embebida. Un atacante podría utilizar ese ID de sesión como parte de la cookie HTTP de una petición web, resultando en una omisión de autenticación.
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-798
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | u.motion_builder | * | <built-in method update of dict object at 0x7e610742ed80> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:* |