CVE-2020-28219 HIGH

Published: 2020-12-11 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX.

Additional Descriptions (1)

Una CWE-522: Se presenta una vulnerabilidad de Credenciales Insuficientemente Protegidas en EcoStruxure Geo SCADA Expert 2019 (versión original y Actualizaciones Mensuales hasta Septiembre de 2020, desde 81.7268.1 hasta 81.7578.1) y EcoStruxure Geo SCADA Expert 2020 (versión original y Actualizaciones Mensuales hasta Septiembre de 2020), desde 83.7551.1 hasta 83.7578.1), que podría causar la exposición de las credenciales a los usuarios del lado del servidor cuando los usuarios web inician sesión en Virtual ViewX

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Base Score: 2.1 (LOW)

AV:L/AC:L/Au:N/C:P/I:N/A:N

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-522

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	ecostruxure_geo_scada_expert_2019	*	<built-in method update of dict object at 0x7e60a8a56200>	Application
schneider-electric	ecostruxure_geo_scada_expert_2020	*	<built-in method update of dict object at 0x7e61114e3c80>	Application

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_geo_scada_expert_2019::::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_geo_scada_expert_2020::::::::`

References

https://www.se.com/ww/en/download/document/SEVD-2020-343-02/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-343-02/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory