| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2020-7571 | 6.7 | medium |
CVE-2020-7571. Multiple improper neutralizations of an input during webpage generation vulnerabilities could allow a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a reflected cross-site scripting attack against other WebReport users.CVE-2020-7571 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
|
| CVE-2020-28210 | 6.7 | medium |
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser.
|
| CVE-2020-7573 | 6.7 | medium |
CVE-2020-7573. An improper access control vulnerability could allow a remote attacker access to restricted web resources due to improper access control.CVE-2020-7573 has been assigned to this vulnerability. A CVSS v3 base score of 5.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).
|
| CVE-2020-7572 | 6.7 | medium |
CVE-2020-7572. An improper restriction of XML external entity reference vulnerability could allow an authenticated remote user to inject arbitrary XML code and obtain disclosure of confidential data, cause a denial-of-service condition, or execute server-side request forgery due to improper configuration of the XML parser.CVE-2020-7572 has been assigned to this vulnerability. A CVSS v3 base score of 6.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:H).
|
| CVE-2020-7569 | 6.7 | medium |
CVE-2020-7569. An unrestricted upload of a file with dangerous type vulnerability could allow an authenticated remote user to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.CVE-2020-7569 has been assigned to this vulnerability. A CVSS v3 base score of 4.6 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).
|
| CVE-2020-7570 | 6.7 | medium |
CVE-2020-7570. An improper neutralization of an input during webpage generation vulnerability could allow an authenticated remote user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a stored cross-site scripting attack against other WebReport users.CVE-2020-7570 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L).
|
| CVE-2020-28209 | 6.7 | medium |
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location.
|
| Vendor | Product | Asset Type | Purdue Level | Firmware |
|---|---|---|---|---|
| Schneider Electric | Schneider Electric EcoStruxure Building Operation Workstation | engineering_workstation |
L3
|
-- |
| Schneider Electric | Schneider Electric EcoStruxure Building Operation WebStation | engineering_workstation |
L3
|
-- |
| Schneider Electric | Schneider Electric EcoStruxure™ Building Operation Enterprise Server | engineering_workstation |
L3
|
-- |
| Schneider Electric | Schneider Electric EcoStruxure™ Building Operation Enterprise Central | engineering_workstation |
L3
|
-- |
| Schneider Electric | Schneider Electric EcoStruxure™ Building Operation Workstation | engineering_workstation |
L3
|
-- |