PT-2017-16352 · Schneider Electric · Wonderware Intouch Access Anywhere

Jan Bee + 1 · Publicado 2017-04-20 · Atualizado 2021-09-09 · CVE-2017-5158

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware InTouch Access Anywhere versions prior to 11.5.2

Description An Information Exposure issue allows credentials to be exposed to external systems via specific URL parameters. This is possible because arbitrary destination addresses may be specified, potentially leading to unauthorized access.

Recommendations For versions prior to 11.5.2, update to a version newer than 11.5.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive URL parameters to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-5158

Produtos afetados

Wonderware Intouch Access Anywhere

Referências · 5

• http://securityfocus.com/bid/97256 · Nota
• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5158 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5158 · Aviso do Fabricante