PT-2015-5017 · Schneider Electric · Indusoft Web Studio+1

Publicado 2015-03-29 · Atualizado 2021-05-14 · CVE-2015-0999

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric InduSoft Web Studio versions prior to 7.1.3.4 SP3 Patch 4 Schneider Electric InTouch Machine Edition 2014 versions prior to 7.1.3.4 SP3 Patch 4

Description The issue allows local users to obtain sensitive information by reading a configuration file that stores cleartext OPC User credentials.

Recommendations For Schneider Electric InduSoft Web Studio versions prior to 7.1.3.4 SP3 Patch 4, update to version 7.1.3.4 SP3 Patch 4 or later. For Schneider Electric InTouch Machine Edition 2014 versions prior to 7.1.3.4 SP3 Patch 4, update to version 7.1.3.4 SP3 Patch 4 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-0999

Produtos afetados

Intouch Machine Edition 2014

Indusoft Web Studio

Referências · 4

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-0999 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 · Nota
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 · Aviso do Fabricante