PT-2016-3154 · United Security Providers · U.Motion Builder

Published 2016-03-29 · Updated 2017-09-27 · CVE-2017-7973

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions U.motion Builder versions 1.2.1 and prior

Description The issue is caused by inadequate protection measures for the SQL query structure in the U.motion Builder software. This allows a remote attacker to exploit the vulnerability and execute arbitrary SQL commands against the underlying database. An unauthenticated user can use calls to various paths to perform these actions.

Recommendations For versions 1.2.1 and prior, consider restricting access to the SQL query structure until a patch is available. As a temporary workaround, avoid using the vulnerable SQL query functionality in the U.motion Builder software until the issue is resolved. Restrict access to the underlying database to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2017-01820

CVE-2017-7973

Affected Products

U.Motion Builder

References · 9

• https://osv.dev/vulnerability/CVE-2017-7973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7973 · Security Note
• http://schneider-electric.com/en/download/document/SEVD-2017-178-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01820 · Security Note
• http://telussecuritylabs.com/threats/show/TSL20170612-08 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-180-02 · Note
• https://checkpoint.com/defense/advisories/public/2017/cpai-2017-0554.html · Note
• http://zerodayinitiative.com/advisories/ZDI-17-374 · Note
• http://securityfocus.com/bid/99344 · Note