PT-2013-2529 · Invensys · Invensys Wonderware Information Server

Denis Baranov + 6 · Published 2013-05-09 · Updated 2013-05-09 · CVE-2013-0684

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands.

Recommendations For Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-0684

Affected Products

Invensys Wonderware Information Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-0684 · Security Note
• http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 · Note