A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.
Existe una vulnerabilidad CWE-502: deserialización de datos no confiables que podría permitir que un atacante que haya iniciado sesión con una cuenta de nivel de usuario obtenga mayores privilegios al proporcionar un objeto serializado dañino.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-502
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | easergy_studio | * | <built-in method update of dict object at 0x7e6110a56e40> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:easergy_studio:*:*:*:*:*:*:*:* |