CVE-2023-5629 HIGH

Published: 2023-12-14 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over HTTP.

Additional Descriptions (1)

Existe una vulnerabilidad CWE-601: Redirección de URL a un sitio que no es de confianza ("Open Redirect") que podría provocar la divulgación de información mediante intentos de phishing a través de HTTP.

CVSS Metrics

Base Score: 6.1 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	REQUIRED
Scope	CHANGED
Confidentiality Impact	LOW
Integrity Impact	LOW
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 2.7

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-601

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	eb450_firmware	-	<built-in method update of dict object at 0x7e60e8816700>	Operating System
schneider-electric	eb45e_firmware	-	<built-in method update of dict object at 0x7e60a8a54240>	Operating System
schneider-electric	eh450_firmware	-	<built-in method update of dict object at 0x7e6071e55f40>	Operating System
schneider-electric	eh45e_firmware	-	<built-in method update of dict object at 0x7e60a8a555c0>	Operating System
schneider-electric	er450_firmware	-	<built-in method update of dict object at 0x7e60a8ba9380>	Operating System
schneider-electric	er45e_firmware	-	<built-in method update of dict object at 0x7e60a8ba91c0>	Operating System
schneider-electric	jr240_firmware	-	<built-in method update of dict object at 0x7e60bb886b80>	Operating System
schneider-electric	jr900_firmware	-	<built-in method update of dict object at 0x7e60eb2e2e00>	Operating System
schneider-electric	qr450_firmware	*	<built-in method update of dict object at 0x7e60a8a57740>	Operating System
schneider-electric	qr150_firmware	*	<built-in method update of dict object at 0x7e60a8ba9f40>	Operating System
schneider-electric	qb450_firmware	*	<built-in method update of dict object at 0x7e60a8a552c0>	Operating System
schneider-electric	qb150_firmware	*	<built-in method update of dict object at 0x7e60a8a57cc0>	Operating System
schneider-electric	qp450_firmware	*	<built-in method update of dict object at 0x7e6071e54a00>	Operating System
schneider-electric	qp150_firmware	*	<built-in method update of dict object at 0x7e60bafaed80>	Operating System
schneider-electric	qh450_firmware	*	<built-in method update of dict object at 0x7e60bafacd00>	Operating System
schneider-electric	qh150_firmware	*	<built-in method update of dict object at 0x7e60bafad340>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eb450_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eb450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eb45e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eb45e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eh450_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eh450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:eh45e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:eh45e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:er450_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:er450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:er45e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:er45e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:jr240_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:jr240:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:jr900_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:jr900:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qr450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qr450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qr150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qr150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qb450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qb450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qb150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qb150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qp450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qp450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qp150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qp150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qh450_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qh450:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:qh150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:qh150:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf
Source: [email protected]

Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory