PT-2017-17985 · Schneider Electric · Wonderware Historian Client

Andrey Zhukov · Publicado 2017-05-19 · Atualizado 2017-07-08 · CVE-2017-7907

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Historian Client versions 2014 R2 SP1 and prior

Description An issue with the XML parser configuration was found, which may allow an attacker to cause a denial of service or disclose file contents from a server or connected network by entering malicious input through the application. This is due to an improperly restricted XML parser that allows XML external entity reference (XXE).

Recommendations For Schneider Electric Wonderware Historian Client versions 2014 R2 SP1 and prior, consider restricting or properly configuring the XML parser to prevent XXE attacks as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-7907

Produtos afetados

Wonderware Historian Client

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-7907 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7907 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-17-122-01 · Nota
• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000120 · Aviso do Fabricante
• http://securityfocus.com/bid/98254 · Nota
• http://securitytracker.com/id/1038542 · Nota