A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.
Una CWE-284: Se presenta una vulnerabilidad Control de Acceso Inapropiado en el Software EcoStruxureª y SmartStruxureª Power Monitoring and SCADA (véase la notificación de seguridad para la información de la versión) que podría permitir una ejecución de código arbitraria en el servidor cuando un usuario autorizado accede a una página web afectada
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | HIGH |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:S/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | SINGLE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-284
|
| [email protected] | Primary |
en
NVD-CWE-Other
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_energy_expert | 2.0 | <built-in method update of dict object at 0x733cd8e18ec0> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 7.0 | <built-in method update of dict object at 0x733cd8e187c0> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 8.0 | <built-in method update of dict object at 0x733cd8e18500> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 9.0 | <built-in method update of dict object at 0x733e3fd7eac0> | Application |
| schneider-electric | power_manager | 1.1 | <built-in method update of dict object at 0x733cd8e1b340> | Application |
| schneider-electric | power_manager | 1.2 | <built-in method update of dict object at 0x733cd8e26880> | Application |
| schneider-electric | power_manager | 1.3 | <built-in method update of dict object at 0x733cd8e19140> | Application |
| schneider-electric | powerscada_expert_with_advanced_reporting_and_dashboards | 8.0 | <built-in method update of dict object at 0x733cd8e19cc0> | Application |
| schneider-electric | powerscada_operation_with_advanced_reporting_and_dashboards | 9.0 | <built-in method update of dict object at 0x733cd8e18180> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:* |