var-201705-3755
Vulnerability from variot
An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network. Schneider Electric Wonderware Historian is a set of industrial data management software from Schneider Electric that combines high-speed data acquisition storage systems with traditional relational database management systems. A local attacker could exploit the vulnerability to access sensitive information and cause a denial of service
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201705-3755",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wonderware historian client",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2014_r2"
},
{
"model": "wonderware historian client",
"scope": "lte",
"trust": 0.8,
"vendor": "schneider electric",
"version": "2014 r2 sp1"
},
{
"model": "electric wonderware historian client r2 sp1",
"scope": "lte",
"trust": 0.6,
"vendor": "schneider",
"version": "\u003c=2014"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider electric",
"version": "2014_r2"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "9.5"
},
{
"model": "wonderware historian client r2 sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2014"
},
{
"model": "wonderware historian client r2",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2014"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.1"
},
{
"model": "wonderware historian client sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.0"
},
{
"model": "wonderware historian client sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.0"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "wonderware historian client",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:schneider_electric:wonderware_historian_client",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Andrey Zhukov from USSC",
"sources": [
{
"db": "BID",
"id": "98254"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
],
"trust": 0.9
},
"cve": "CVE-2017-7907",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"id": "CVE-2017-7907",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2017-07253",
"impactScore": 9.2,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c",
"impactScore": 9.2,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"id": "CVE-2017-7907",
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-7907",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-7907",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2017-07253",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201705-227",
"trust": 0.6,
"value": "LOW"
},
{
"author": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c",
"trust": 0.2,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network. Schneider Electric Wonderware Historian is a set of industrial data management software from Schneider Electric that combines high-speed data acquisition storage systems with traditional relational database management systems. A local attacker could exploit the vulnerability to access sensitive information and cause a denial of service",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-7907",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-17-122-01",
"trust": 2.7
},
{
"db": "BID",
"id": "98254",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1038542",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2017-07253",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298",
"trust": 0.8
},
{
"db": "NSFOCUS",
"id": "36601",
"trust": 0.6
},
{
"db": "IVD",
"id": "FCB932EF-D97A-42D4-80C4-2C94B48ED73C",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"id": "VAR-201705-3755",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
}
],
"trust": 1.59166665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
}
]
},
"last_update_date": "2024-11-23T23:05:26.244000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Wonderware Historian Client XML Injection Vulnerability",
"trust": 0.8,
"url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000120/"
},
{
"title": "Patch for Wonderware Historian Client Local XML External Entity Injection Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/93992"
},
{
"title": "Schneider Electric Wonderware Historian Client Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=69853"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-611",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-122-01"
},
{
"trust": 2.2,
"url": "http://www.securityfocus.com/bid/98254"
},
{
"trust": 1.9,
"url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000120/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7907"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id/1038542"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7907"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/36601"
},
{
"trust": 0.3,
"url": "http://www.schneider-electric.com/products/ww/en/"
},
{
"trust": 0.3,
"url": "https://www.wonderware.com/industrial-information-management/historian-client/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-05-23T00:00:00",
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"date": "2017-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"date": "2017-05-02T00:00:00",
"db": "BID",
"id": "98254"
},
{
"date": "2017-06-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"date": "2017-05-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"date": "2017-05-19T03:29:00.590000",
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"date": "2017-05-18T16:17:00",
"db": "BID",
"id": "98254"
},
{
"date": "2017-06-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"date": "2017-05-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201705-227"
},
{
"date": "2024-11-21T03:32:56.340000",
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "98254"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Wonderware Historian Client local XML External entity injection vulnerability",
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…