PT-2018-18279 · Schneider Electric · Somachine Basic

Published 2018-07-03 · Updated 2022-01-31 · CVE-2018-7783

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Schneider Electric SoMachine Basic versions prior to 1.6 SP1

Description: The issue is related to an XML External Entity (XXE) vulnerability, which uses the DTD parameter entities technique. This results in the disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.

Recommendations: For Schneider Electric SoMachine Basic versions prior to 1.6 SP1, update to version 1.6 SP1 or later to resolve the issue. As a temporary workaround, consider sanitizing the input passed to the xml parser to prevent exploitation. Restrict access to the xml project/template file to minimize the risk of arbitrary data disclosure.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-7783

Affected Products

Somachine Basic

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-7783 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2018-142-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7783 · Vendor Advisory
• https://t.me/cvenotify/19908 · Telegram Post