A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.
Una CWE-79: Se presenta una vulnerabilidad Neutralización Inapropiada de la Entrada Durante la Generación de Páginas Web en el Software EcoStruxureª y SmartStruxureª Power Monitoring and SCADA (véase la notificación de seguridad para la información de la versión) que podría permitir a un atacante llevar a cabo acciones en nombre del usuario autorizado cuando se acceder a un página web afectada
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | NONE |
AV:N/AC:M/Au:S/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | SINGLE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-79
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_energy_expert | 2.0 | <built-in method update of dict object at 0x7e6111c1d0c0> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 7.0 | <built-in method update of dict object at 0x7e6111c1cb80> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 8.0 | <built-in method update of dict object at 0x7e60e8c7f840> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 9.0 | <built-in method update of dict object at 0x7e60a88ac440> | Application |
| schneider-electric | power_manager | 1.1 | <built-in method update of dict object at 0x7e6111c1dbc0> | Application |
| schneider-electric | power_manager | 1.2 | <built-in method update of dict object at 0x7e60a88ace00> | Application |
| schneider-electric | power_manager | 1.3 | <built-in method update of dict object at 0x7e60e8c7cbc0> | Application |
| schneider-electric | powerscada_expert_with_advanced_reporting_and_dashboards | 8.0 | <built-in method update of dict object at 0x7e60a88ad680> | Application |
| schneider-electric | powerscada_operation_with_advanced_reporting_and_dashboards | 9.0 | <built-in method update of dict object at 0x7e60e8c7e580> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:* |