PT-2018-2172 · Schneider Electric · Bmxnor0200+3

Publicado 2018-11-23 · Atualizado 2020-08-24 · CVE-2018-7831

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which can be exploited to execute a password change on the web server. An attacker can send a specially crafted URL to a currently authenticated web server user to initiate the password change procedure. This can allow an attacker to change the password of an authenticated user.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

CSRF

Enumeração de Fraquezas

CWE-80

CWE-79

CWE-352

Identificadores relacionados

BDU:2019-00125

CVE-2018-7831

Produtos afetados

Bmxnor0200

Modicon M340

Premium

Quantum

Referências · 4

• 🔥 https://tenable.com/security/research/tra-2018-38 · Exploit
• https://bdu.fstec.ru/vul/2019-00125 · Nota de Segurança
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7831 · Nota de Segurança