The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.
Existe una vulnerabilidad en el applet runscript.php en el software de Schneider Electric U.motion Builder en versiones anteriores a la v1.3.4. Existe una vulnerabilidad de salto de directorio en el procesamiento del parámetro "s" del applet.
AV:N/AC:M/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-22
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | u.motion_builder | * | <built-in method update of dict object at 0x7e60a87b5100> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:* |