Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2017-9956
Vulnerability from cvelistv5
Published
2017-09-25 19:00
Modified
2024-09-17 00:37
Severity ?
EPSS score ?
Summary
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cybersecurity@se.com | http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ | Vendor Advisory | |
| cybersecurity@se.com | http://www.securityfocus.com/bid/99344 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99344 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Schneider Electric SE | U.Motion |
Version: U.motion Builder Versions 1.2.1 and prior. |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:24:59.862Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"name": "99344",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99344"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "U.Motion",
"vendor": "Schneider Electric SE",
"versions": [
{
"status": "affected",
"version": "U.motion Builder Versions 1.2.1 and prior."
}
]
}
],
"datePublic": "2017-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Authentication",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-26T09:57:01",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"name": "99344",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99344"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"DATE_PUBLIC": "2017-06-28T00:00:00",
"ID": "CVE-2017-9956",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "U.Motion",
"version": {
"version_data": [
{
"version_value": "U.motion Builder Versions 1.2.1 and prior."
}
]
}
}
]
},
"vendor_name": "Schneider Electric SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/",
"refsource": "CONFIRM",
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"name": "99344",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99344"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2017-9956",
"datePublished": "2017-09-25T19:00:00Z",
"dateReserved": "2017-06-26T00:00:00",
"dateUpdated": "2024-09-17T00:37:07.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-9956\",\"sourceIdentifier\":\"cybersecurity@se.com\",\"published\":\"2017-09-26T01:29:03.837\",\"lastModified\":\"2024-11-21T03:37:14.940\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en las versiones 1.2.1 y anteriores del software de U.motion Builder de Schneider Electric en la que el sistema contiene una sesi\u00f3n v\u00e1lida embebida. Un atacante podr\u00eda utilizar ese ID de sesi\u00f3n como parte de la cookie HTTP de una petici\u00f3n web, resultando en una omisi\u00f3n de autenticaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.1\",\"matchCriteriaId\":\"849D3761-51AA-4820-B995-BBB065B8086B\"}]}]}],\"references\":[{\"url\":\"http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/\",\"source\":\"cybersecurity@se.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/99344\",\"source\":\"cybersecurity@se.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/99344\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
}
}
icsa-17-180-02
Vulnerability from csaf_cisa
Published
2017-06-29 00:00
Modified
2019-01-08 00:00
Summary
Schneider Electric U.motion Builder (Update A)
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
A successful exploit of these vulnerabilities could allow an attacker to execute arbitrary commands or compromise the confidentiality, integrity, and availability of the system.
Critical infrastructure sectors
Commercial Facilities, Critical Manufacturing, and Energy
Countries/areas deployed
United States, Europe, and Asia
Company headquarters location
France
Recommended Practices
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"names": [
"rgod"
],
"organization": "Trend Micro \u0027s Zero Day Initiative, Constantin-Cosmin CRACIUN, and Schneider Electric",
"summary": "identifying these vulnerabilities"
},
{
"names": [
"Constantin-Cosmin CRACIUN"
],
"summary": "identifying these vulnerabilities"
},
{
"organization": "Schneider Electric",
"summary": "identifying these vulnerabilities"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "A successful exploit of these vulnerabilities could allow an attacker to execute arbitrary commands or compromise the confidentiality, integrity, and availability of the system.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Commercial Facilities, Critical Manufacturing, and Energy",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "United States, Europe, and Asia",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "France",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-17-180-02 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-180-02.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-17-180-02 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-180-02"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Schneider Electric U.motion Builder (Update A)",
"tracking": {
"current_release_date": "2019-01-08T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-17-180-02",
"initial_release_date": "2017-06-29T00:00:00.000000Z",
"revision_history": [
{
"date": "2017-06-29T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-17-180-02 Schneider Electric U.motion Builder"
},
{
"date": "2017-06-29T00:00:00.000000Z",
"legacy_version": "A",
"number": "2",
"summary": "ICSA-17-180-02 Schneider Electric U.motion Builder (Update A)"
},
{
"date": "2019-01-08T00:00:00.000000Z",
"legacy_version": "B",
"number": "3",
"summary": "ICSA-17-180-02 Schneider Electric U.motion Builder (Update B)"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.2.1",
"product": {
"name": "U.motion Builder: Versions 1.2.1 and prior",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "U.motion Builder"
}
],
"category": "vendor",
"name": "Schneider Electric Software, LLC"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-7973",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Unauthenticated users can use calls to various paths in order to perform arbitrary SQL statements against the underlying database.CVE-2017-7973 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7973"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7765",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of track_import_export.php. The underlying SQLite database query is subject to SQL injection on the object_id input parameter.CVE-2018-7765 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7765"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7766",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of track_getdata.php. The underlying SQLite database query is subject to SQL injection on the id input parameter.CVE-2018-7766 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7766"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7767",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of editobject.php. The underlying SQLite database query is subject to SQL injection on the type input parameter.CVE-2018-7767 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7767"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7768",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of loadtemplate.php. The underlying SQLite database query is subject to SQL injection on the tpl input parameter.CVE-2018-7768 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7768"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7769",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of xmlserver.php. The underlying SQLite database query is subject to SQL injection on the id input parameter.CVE-2018-7769 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7769"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7772",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of applets that are exposed on the web service. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the request.CVE-2018-7772 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7772"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7773",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of nfcserver.php. The underlying SQLite database query is subject to SQL injection on the sessionid input parameter.CVE-2018-7773 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7773"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7774",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of localize.php. The underlying SQLite database query is subject to SQL injection on the username input parameter.CVE-2018-7774 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7774"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-7974",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Unauthenticated users can execute arbitrary code and exfiltrate files.CVE-2017-7974 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7974"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7763",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within css.inc.php. The \u0027css\u0027 parameter contains a directory traversal vulnerability.CVE-2018-7763 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7763"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7764",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within runscript.php applet. There is a directory traversal vulnerability in the processing of the \u0027s\u0027 parameter of the applet.CVE-2018-7764 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7764"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7770",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of sendmail.php. The applet allows callers to select arbitrary files to send to an arbitrary email address.CVE-2018-7770 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7770"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7771",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within processing of editscript.php. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.CVE-2018-7771 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7771"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-9956",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "summary",
"text": "The system includes a hard-coded valid session. If an attacker uses that session ID as part of the HTTP cookie of a web request, then authentication is bypassed.CVE-2017-9956 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9956"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-9957",
"cwe": {
"id": "CWE-259",
"name": "Use of Hard-coded Password"
},
"notes": [
{
"category": "summary",
"text": "The system comes with a system web access account hard-coded.CVE-2017-9957 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9957"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-9958",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of the system configuration can allow an attacker to execute arbitrary code under the context of root.CVE-2017-9958 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9958"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-9959",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "summary",
"text": "The system accepts reboot in session from unauthenticated user causing a denial of service.CVE-2017-9959 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9959"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-9960",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "summary",
"text": "The system returns more information than should be passed to an unauthenticated caller who might be an attacker.CVE-2017-9960 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9960"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7776",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability exists within externalframe.php. Exception information is returned to the attacker that contains sensitive path information.CVE-2018-7776 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7776"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2018-7777",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The vulnerability is due to insufficient handling of update_file request parameter on update_module.php. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.CVE-2018-7777 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7777"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-7494",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Samba since Version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.CVE-2017-7494 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7494"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric\u0027s security notice SEVD-2017-178-01 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"category": "vendor_fix",
"details": "Firmware update Version 1.3.4, which includes fixes for most of these vulnerabilities, has been released. It is highly recommended that U.motion Builder users apply the patch in a timely manner.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "The firmware is available for download",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/SE_UMOTION_BUILDER/"
},
{
"category": "mitigation",
"details": "U.motion server firmware update Version 1.3.4 is available",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.schneider-electric.com/en/download/document/Umotion_Server_update/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
}
]
}
ghsa-w5f6-9h7r-9v63
Vulnerability from github
Published
2022-05-17 00:47
Modified
2022-05-17 00:47
Severity ?
Details
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass
{
"affected": [],
"aliases": [
"CVE-2017-9956"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-26T01:29:00Z",
"severity": "HIGH"
},
"details": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass",
"id": "GHSA-w5f6-9h7r-9v63",
"modified": "2022-05-17T00:47:38Z",
"published": "2022-05-17T00:47:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9956"
},
{
"type": "WEB",
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99344"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
gsd-2017-9956
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-9956",
"description": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass",
"id": "GSD-2017-9956"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-9956"
],
"details": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass",
"id": "GSD-2017-9956",
"modified": "2023-12-13T01:21:07.682019Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"DATE_PUBLIC": "2017-06-28T00:00:00",
"ID": "CVE-2017-9956",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "U.Motion",
"version": {
"version_data": [
{
"version_value": "U.motion Builder Versions 1.2.1 and prior."
}
]
}
}
]
},
"vendor_name": "Schneider Electric SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/",
"refsource": "CONFIRM",
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"name": "99344",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99344"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.2.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2017-9956"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/"
},
{
"name": "99344",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99344"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
},
"lastModifiedDate": "2017-09-27T20:45Z",
"publishedDate": "2017-09-26T01:29Z"
}
}
}
var-201709-1219
Vulnerability from variot
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of session management. The application has a hard-coded static session ID. U.motion Builder is a generator product from Schneider Electric, France. An SQL-injection vulnerability 2. A directory-traversal vulnerability 3. An information-disclosure vulnerability 5. A local code-execution vulnerability 6. A local denial-of-Service vulnerability 7. An information-disclosure vulnerability Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, bypass authentication mechanism, obtain sensitive information, execute arbitrary code and perform unauthorized actions. Failed exploits can result in a denial-of-service condition
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "u.motion builder",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "1.2.1"
},
{
"_id": null,
"model": "u.motion builder",
"scope": "eq",
"trust": 0.9,
"vendor": "schneider electric",
"version": "1.2.1"
},
{
"_id": null,
"model": "u.motion builder software",
"scope": "lte",
"trust": 0.8,
"vendor": "schneider electric",
"version": "1.2.1"
},
{
"_id": null,
"model": "u.motion builder",
"scope": null,
"trust": 0.7,
"vendor": "schneider electric",
"version": null
},
{
"_id": null,
"model": "electric u.motion builder",
"scope": null,
"trust": 0.6,
"vendor": "schneider",
"version": null
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "u motion builder",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1"
},
{
"db": "ZDI",
"id": "ZDI-17-391"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
},
{
"db": "BID",
"id": "99344"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1092"
},
{
"db": "NVD",
"id": "CVE-2017-9956"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:schneider_electric:u.motion_builder",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
}
]
},
"credits": {
"_id": null,
"data": "rgod",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-391"
}
],
"trust": 0.7
},
"cve": "CVE-2017-9956",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-9956",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "ZDI-17-391",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-09480",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2017-9956",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-9956",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-9956",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "ZDI-17-391",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-09480",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-1092",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1"
},
{
"db": "ZDI",
"id": "ZDI-17-391"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1092"
},
{
"db": "NVD",
"id": "CVE-2017-9956"
}
]
},
"description": {
"_id": null,
"data": "An authentication bypass vulnerability exists in Schneider Electric\u0027s U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request, resulting in authentication bypass. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of session management. The application has a hard-coded static session ID. U.motion Builder is a generator product from Schneider Electric, France. An SQL-injection vulnerability\n2. A directory-traversal vulnerability\n3. An information-disclosure vulnerability\n5. A local code-execution vulnerability\n6. A local denial-of-Service vulnerability\n7. An information-disclosure vulnerability\nExploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, bypass authentication mechanism, obtain sensitive information, execute arbitrary code and perform unauthorized actions. Failed exploits can result in a denial-of-service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9956"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
},
{
"db": "ZDI",
"id": "ZDI-17-391"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
},
{
"db": "BID",
"id": "99344"
},
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1"
}
],
"trust": 3.24
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2017-9956",
"trust": 3.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2017-178-01",
"trust": 1.9
},
{
"db": "BID",
"id": "99344",
"trust": 1.9
},
{
"db": "ZDI",
"id": "ZDI-17-391",
"trust": 1.3
},
{
"db": "ICS CERT",
"id": "ICSA-17-180-02",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2017-09480",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1092",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-3582",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "37012",
"trust": 0.6
},
{
"db": "IVD",
"id": "F1BA68B9-AEC6-401E-BA62-C9FC06AEDDA1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1"
},
{
"db": "ZDI",
"id": "ZDI-17-391"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
},
{
"db": "BID",
"id": "99344"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1092"
},
{
"db": "NVD",
"id": "CVE-2017-9956"
}
]
},
"id": "VAR-201709-1219",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
}
]
},
"last_update_date": "2024-11-23T20:33:03.451000Z",
"patch": {
"_id": null,
"data": [
{
"title": "SEVD-2017-178-01",
"trust": 0.8,
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Id=8203873940\u0026p_File_Name=SEVD-2017-178-01+U.motion+Builder+Software.pdf\u0026p_Reference=SEVD-2017-178-01"
},
{
"title": "This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.03/29/2016 - ZDI disclosed the vulnerability reports to ICS-CERT (with an expected \u0027due date\u0027 of 07/27/16).03/29/2016 - ICS-CERT acknowledged that they received them and \"sent them on to our contacts at Schneider Electric, and will keep you informed of their progress. We are tracking these issues as ICS-VU-291195.\"08/24/2016 - ZDI sent a follow-up inquiry to ICS-CERT requesting the status.09/08/2016 - ICS-CERT replied requesting more information on one vulnerability report, but said of the others, \"they have successfully validated the rest of the vulnerability reports. Unfortunately, they don\u0027t expect to have a patch ready until the end of this year.\" ICS-CERT suggested they would work with the vendor to try to bring this in.09/19/2016 - ZDI sent a follow-up inquiry to ICS-CERT asking if the vendor was anywhere closer.10/11/2016 - ZDI sent a follow-up inquiry to ICS-CERT asking if the vendor was anywhere closer and stressed potential 0-day.12/14/2016 - ZDI sent a follow-up inquiry to ICS-CERT requesting the status.06/02/2017 - ZDI sent a follow-up inquiry to ICS-CERT requesting the status.-- Mitigation:Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in and numerous other Microsoft Knowledge Base articles.",
"trust": 0.7,
"url": "http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-391"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-798",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
},
{
"db": "NVD",
"id": "CVE-2017-9956"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 1.9,
"url": "http://www.schneider-electric.com/en/download/document/sevd-2017-178-01/"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/99344"
},
{
"trust": 1.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-180-02"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9956"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9956"
},
{
"trust": 0.7,
"url": "http://technet.microsoft.com/en-us/library/cc725770%28ws.10%29.aspx"
},
{
"trust": 0.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-391/"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/37012"
},
{
"trust": 0.3,
"url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-391"
},
{
"db": "CNVD",
"id": "CNVD-2017-09480"
},
{
"db": "BID",
"id": "99344"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1092"
},
{
"db": "NVD",
"id": "CVE-2017-9956"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-391",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2017-09480",
"ident": null
},
{
"db": "BID",
"id": "99344",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008207",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1092",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2017-9956",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2017-06-14T00:00:00",
"db": "IVD",
"id": "f1ba68b9-aec6-401e-ba62-c9fc06aedda1",
"ident": null
},
{
"date": "2017-06-12T00:00:00",
"db": "ZDI",
"id": "ZDI-17-391",
"ident": null
},
{
"date": "2017-06-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-09480",
"ident": null
},
{
"date": "2017-06-30T00:00:00",
"db": "BID",
"id": "99344",
"ident": null
},
{
"date": "2017-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008207",
"ident": null
},
{
"date": "2017-06-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1092",
"ident": null
},
{
"date": "2017-09-26T01:29:03.837000",
"db": "NVD",
"id": "CVE-2017-9956",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2017-06-12T00:00:00",
"db": "ZDI",
"id": "ZDI-17-391",
"ident": null
},
{
"date": "2017-06-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-09480",
"ident": null
},
{
"date": "2017-06-30T00:00:00",
"db": "BID",
"id": "99344",
"ident": null
},
{
"date": "2019-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008207",
"ident": null
},
{
"date": "2017-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1092",
"ident": null
},
{
"date": "2024-11-21T03:37:14.940000",
"db": "NVD",
"id": "CVE-2017-9956",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1092"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Schneider Electric U.motion Builder Software Vulnerabilities related to the use of hard-coded credentials",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008207"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1092"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.