PT-2012-3712 · Schneider Electric · Kerwin+1

Published 2012-05-22 · Updated 2013-05-15 · CVE-2012-1990

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric Kerweb versions prior to 3.0.1 Schneider Electric Kerwin versions prior to 6.0.1

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the evtvariablename parameter in an evts.xml action to kw.dll, unspecified search fields, or unspecified content-display fields.

Recommendations For Schneider Electric Kerweb versions prior to 3.0.1, update to version 3.0.1 or later. For Schneider Electric Kerwin versions prior to 6.0.1, update to version 6.0.1 or later. As a temporary workaround, consider restricting access to the kw.dll and evts.xml actions until a patch is available. Avoid using the evtvariablename parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1990

Affected Products

Kerweb

Kerwin

References · 5

• 🔥 https://exploit-db.com/exploits/37137 · Exploit
• http://secunia.com/advisories/49041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1990 · Security Note
• http://phocean.net/2012/05/08/cve-2012-1990-kerwebkerwin-xss-vulnerabilities.html · Note
• http://securityfocus.com/bid/53409 · Note