PT-2017-17985 · Schneider Electric · Wonderware Historian Client

Andrey Zhukov · Published 2017-05-19 · Updated 2017-07-08 · CVE-2017-7907

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Historian Client versions 2014 R2 SP1 and prior

Description An issue with the XML parser configuration was found, which may allow an attacker to cause a denial of service or disclose file contents from a server or connected network by entering malicious input through the application. This is due to an improperly restricted XML parser that allows XML external entity reference (XXE).

Recommendations For Schneider Electric Wonderware Historian Client versions 2014 R2 SP1 and prior, consider restricting or properly configuring the XML parser to prevent XXE attacks as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-7907

Affected Products

Wonderware Historian Client

References · 6

• https://osv.dev/vulnerability/CVE-2017-7907 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7907 · Security Note
• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000120 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-17-122-01 · Note
• http://securityfocus.com/bid/98254 · Note
• http://securitytracker.com/id/1038542 · Note