Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
Schneider Electric SoMachine Basic en versiones anteriores a la v1.6 SP1 sufre una vulnerabilidad XXE (XML External Entity) mediante la técnica de entidades de parámetros DTD, resultando en la revelación y recuperación de datos arbitrarios en el nodo afectado mediante un ataque OOB (out-of-band). La vulnerabilidad se desencadena cuando la entrada pasada al analizador xml no se sanea cuando se analiza el archivo de proyecto/plantilla xml.
AV:N/AC:L/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-611
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | somachine_basic | * | <built-in method update of dict object at 0x7e60eb2e28c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:somachine_basic:*:*:*:*:*:*:*:* |