PT-2018-1636 · Wecon Technology · Pi Studio+1

Publicado 2018-10-02 · Atualizado 2019-10-09 · CVE-2018-17889

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Média

Vetor base

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior

Description The issue is caused by incorrect restriction of XML links to external objects in the XML analyzer of PI Studio development tools. This may allow a remote attacker to disclose protected information. The XMLParser in WECON PIStudio is vulnerable to an XML external entity injection attack when parsing project files, potentially leading to sensitive information disclosure.

Recommendations For WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior: Update to a version later than 4.1.9 to resolve the issue. For WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior: Update to a version later than 4.2.34 to resolve the issue. As a temporary workaround, consider restricting access to the XMLParser until a patch is available.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2018-01195

CVE-2018-17889

ZDI-18-1106

Produtos afetados

Pi Studio

Pi Studio Hmi

Referências · 5

• https://zerodayinitiative.com/advisories/ZDI-18-1106 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17889 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17889 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 · Nota
• https://bdu.fstec.ru/vul/2018-01195 · Nota de Segurança