Andover Continuum System (V2.1)

Schneider Electric Security Notification 10-Mar-20 (12-May-20) Document Reference Number – SEVD-2020 -070-04 (V2.1) Page 1 of 4 ## Andover Continuum System (V2.1) 10 March 2020 (12 May 2020) ## Overview Schneider Electric is aware of multiple vulnerabilities in the Andover Continuum product line. Andover Continuum allows users to view and control functions of the Continuum system. ## Affected Product(s) All Continuum versions are affected. ## Vulnerability Details CVE ID: CVE-2020-7480 CVSS v3.0 Base Score 8.8 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Continuum XML Vulnerability – The CyberStation product uses the MS-XML version 4.0 library. Issues in this Microsoft functionality may leave CyberStation open to attack. A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data. CVE ID: CVE-2020-7481 CVSS v3.0 Base Score 6.1 | Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Continuum XSS Vulnerability – The web.Client has a Cross Site Scripting (XSS) vulnerability that may expose the user to various possible attacks. A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists which could enable a successful “Cross-site Scripting” (XSS attack) when using the products’ web server. Schneider Electric Security Notification 10-Mar-20 (12-May-20) Document Reference Number – SEVD-2020 -070-04 (V2.1) Page 2 of 4 CVE ID: CVE-2020-7482 CVSS v3.0 Base Score 6.1 | Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Continuum Reflected XSS Vulnerability – The web.Client has a Reflected Cross Site Scripting (XSS) vulnerability that might allow an attacker to execute unintended code in the context of the user.