PT-2018-8543 · Schneider Electric · Powerscada Anywhere+2

Publicado 2018-02-12 · Atualizado 2019-04-23 · CVE-2017-9963

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PowerSCADA Anywhere version 1.0 PowerSCADA Expert versions 8.1 through 8.2 Citect Anywhere version 1.0

Description A cross-site request forgery issue exists in the Secure Gateway component, allowing for multiple state-changing requests. This type of attack requires social engineering to trick a legitimate user into accessing a malicious link or site containing the CSRF attack.

Recommendations For PowerSCADA Anywhere version 1.0, update the Secure Gateway component to prevent cross-site request forgery attacks. For PowerSCADA Expert versions 8.1 through 8.2, ensure the Secure Gateway component is updated to mitigate the risk of CSRF attacks. For Citect Anywhere version 1.0, consider restricting access to the Secure Gateway component until a fix is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-9963

Produtos afetados

Citect Anywhere

Powerscada Anywhere

Powerscada Expert

Referências · 4

• http://schneider-electric.com/en/download/document/SEVD-2017-173-01 · Nota
• https://citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9963 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9963 · Aviso do Fabricante