PT-2013-2529 · Invensys · Invensys Wonderware Information Server

Denis Baranov + 6 · Publicado 2013-05-09 · Atualizado 2013-05-09 · CVE-2013-0684

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands.

Recommendations For Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-0684

Produtos afetados

Invensys Wonderware Information Server

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-0684 · Nota de Segurança
• http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 · Nota