cnvd - cnvd-2019-05109

cnvd-2019-05109

Vulnerability from cnvd

Title: Schneider Electric SoMachine Basic XML外部实体注入漏洞

Description:

Schneider Electric SoMachine Basic是法国施耐德电气（Schneider Electric）公司的一款用于在控制平台上对元器件进行编程、调试的软件。

Schneider Electric SoMachine Basic 1.6 SP1版本中存在XML外部实体注入漏洞，该漏洞源于程序未能过滤传入到xml解析器的输入。攻击者可利用该漏洞泄露并检索受影响节点上的任意数据。

Severity: 中

Patch Name: Schneider Electric SoMachine Basic XML外部实体注入漏洞的补丁

Patch Description:

Schneider Electric SoMachine Basic是法国施耐德电气（Schneider Electric）公司的一款用于在控制平台上对元器件进行编程、调试的软件。

Schneider Electric SoMachine Basic 1.6 SP1版本中存在XML外部实体注入漏洞，该漏洞源于程序未能过滤传入到xml解析器的输入。攻击者可利用该漏洞泄露并检索受影响节点上的任意数据。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/

Reference: https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/

Impacted products

Name
Schneider Electric SoMachine Basic 1.6 SP1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-7783"
    }
  },
  "description": "Schneider Electric SoMachine Basic\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u5728\u63a7\u5236\u5e73\u53f0\u4e0a\u5bf9\u5143\u5668\u4ef6\u8fdb\u884c\u7f16\u7a0b\u3001\u8c03\u8bd5\u7684\u8f6f\u4ef6\u3002\n\nSchneider Electric SoMachine Basic 1.6 SP1\u7248\u672c\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8fc7\u6ee4\u4f20\u5165\u5230xml\u89e3\u6790\u5668\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6cc4\u9732\u5e76\u68c0\u7d22\u53d7\u5f71\u54cd\u8282\u70b9\u4e0a\u7684\u4efb\u610f\u6570\u636e\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-05109",
  "openTime": "2019-02-22",
  "patchDescription": "Schneider Electric SoMachine Basic\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u5728\u63a7\u5236\u5e73\u53f0\u4e0a\u5bf9\u5143\u5668\u4ef6\u8fdb\u884c\u7f16\u7a0b\u3001\u8c03\u8bd5\u7684\u8f6f\u4ef6\u3002\r\n\r\nSchneider Electric SoMachine Basic 1.6 SP1\u7248\u672c\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8fc7\u6ee4\u4f20\u5165\u5230xml\u89e3\u6790\u5668\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6cc4\u9732\u5e76\u68c0\u7d22\u53d7\u5f71\u54cd\u8282\u70b9\u4e0a\u7684\u4efb\u610f\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Schneider Electric SoMachine Basic XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Schneider Electric SoMachine Basic 1.6 SP1"
  },
  "referenceLink": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/",
  "serverity": "\u4e2d",
  "submitTime": "2018-07-06",
  "title": "Schneider Electric SoMachine Basic XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2018-7783 (GCVE-0-2018-7783)

Vulnerability from cvelistv5

Published

2018-07-03 14:00

Modified

2024-09-16 21:02

Severity ?

CWE

Out-Of-Band Remote Arbitrary Data Retrieval

Summary

Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.

References

▼	URL	Tags
	https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Schneider Electric SE	SoMachine Basic	Version: SoMachine Basic prior to v1.6 SP1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:37:58.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SoMachine Basic",
          "vendor": "Schneider Electric SE",
          "versions": [
            {
              "status": "affected",
              "version": "SoMachine Basic prior to v1.6 SP1"
            }
          ]
        }
      ],
      "datePublic": "2018-05-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-Of-Band Remote Arbitrary Data Retrieval",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-03T13:57:01",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@schneider-electric.com",
          "DATE_PUBLIC": "2018-05-22T00:00:00",
          "ID": "CVE-2018-7783",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SoMachine Basic",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SoMachine Basic prior to v1.6 SP1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Schneider Electric SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-Of-Band Remote Arbitrary Data Retrieval"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/",
              "refsource": "CONFIRM",
              "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2018-7783",
    "datePublished": "2018-07-03T14:00:00Z",
    "dateReserved": "2018-03-08T00:00:00",
    "dateUpdated": "2024-09-16T21:02:18.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted