var-201709-1097
Vulnerability from variot
A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack. Schneider Electric's PowerSCADA Anywhere and Citect Anywhere Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PowerSCADA Anywhere is SCADA and power monitoring software. Citect is an industrial automation operation and monitoring software. Schneider Electric PowerSCADA Anywhere and Citect Anywhere are prone to the following security vulnerabilities: 1. A cross-site request-forgery vulnerability 2. An information-disclosure vulnerability 3. Multiple security-bypass vulnerabilities Exploiting these issues could allow an attacker to obtain sensitive information, bypass certain security restrictions, perform unauthorized actions, or gain access to the affected system. Following products and versions are vulnerable: PowerSCADA Anywhere 1.0 redistributed with PowerSCADA Expert 8.1 and PowerSCADA Expert 8.2 Citect Anywhere 1.0
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201709-1097",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "powerscada anywhere",
"scope": "eq",
"trust": 2.7,
"vendor": "schneider electric",
"version": "1.0"
},
{
"model": "citect anywhere",
"scope": "eq",
"trust": 2.7,
"vendor": "schneider electric",
"version": "1.0"
},
{
"model": "electric citect anywhere",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider",
"version": "1.0"
},
{
"model": "electric powerscada anywhere",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider",
"version": "1.0"
},
{
"model": "powerscada expert",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "8.2"
},
{
"model": "powerscada expert",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "powerscada anywhere",
"version": "1.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "citect anywhere",
"version": "1.0"
}
],
"sources": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:schneider_electric:citect_anywhere",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:schneider_electric:powerscada_anywhere",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Electric",
"sources": [
{
"db": "BID",
"id": "99913"
}
],
"trust": 0.3
},
"cve": "CVE-2017-7969",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-7969",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 8.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-22845",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 8.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2017-7969",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-7969",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-7969",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2017-22845",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201704-899",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric\u0027s PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack. Schneider Electric\u0027s PowerSCADA Anywhere and Citect Anywhere Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PowerSCADA Anywhere is SCADA and power monitoring software. Citect is an industrial automation operation and monitoring software. Schneider Electric PowerSCADA Anywhere and Citect Anywhere are prone to the following security vulnerabilities:\n1. A cross-site request-forgery vulnerability\n2. An information-disclosure vulnerability\n3. Multiple security-bypass vulnerabilities\nExploiting these issues could allow an attacker to obtain sensitive information, bypass certain security restrictions, perform unauthorized actions, or gain access to the affected system. \nFollowing products and versions are vulnerable:\nPowerSCADA Anywhere 1.0 redistributed with PowerSCADA Expert 8.1 and PowerSCADA Expert 8.2\nCitect Anywhere 1.0",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7969"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-7969",
"trust": 3.5
},
{
"db": "SCHNEIDER",
"id": "SEVD-2017-173-01",
"trust": 1.9
},
{
"db": "BID",
"id": "99913",
"trust": 1.9
},
{
"db": "ICS CERT",
"id": "ICSA-17-201-01",
"trust": 1.5
},
{
"db": "CNVD",
"id": "CNVD-2017-22845",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201704-899",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372",
"trust": 0.8
},
{
"db": "NSFOCUS",
"id": "37196",
"trust": 0.6
},
{
"db": "IVD",
"id": "7455CBDF-ACD0-4108-BBA4-FB9F68930C62",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"id": "VAR-201709-1097",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
}
],
"trust": 1.614484135
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
}
]
},
"last_update_date": "2024-11-23T22:12:40.150000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SEVD-2017-173-01",
"trust": 0.8,
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/"
},
{
"title": "Security Notification - Citect Anywhere",
"trust": 0.8,
"url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"
},
{
"title": "Patch for Schneider Electric PowerSCADA Anywhere/Citect Anywhere Cross-Site Request Forgery Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/100823"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://www.schneider-electric.com/en/download/document/sevd-2017-173-01/"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/99913"
},
{
"trust": 1.6,
"url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere"
},
{
"trust": 1.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-201-01"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7969"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7969"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/37196"
},
{
"trust": 0.3,
"url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"db": "BID",
"id": "99913"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"date": "2017-07-20T00:00:00",
"db": "BID",
"id": "99913"
},
{
"date": "2017-10-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"date": "2017-04-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"date": "2017-09-26T01:29:03.460000",
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22845"
},
{
"date": "2017-07-20T00:00:00",
"db": "BID",
"id": "99913"
},
{
"date": "2017-10-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008372"
},
{
"date": "2017-09-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-899"
},
{
"date": "2024-11-21T03:33:04.120000",
"db": "NVD",
"id": "CVE-2017-7969"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Electric PowerSCADA Anywhere/Citect Anywhere Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7455cbdf-acd0-4108-bba4-fb9f68930c62"
},
{
"db": "CNVD",
"id": "CNVD-2017-22845"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201704-899"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…