PT-2018-8514 · Schneider Electric · Ampla Mes

Published 2018-05-18 · Updated 2019-10-09 · CVE-2017-9637

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric Ampla MES versions 6.4 and prior

Description The issue allows an attacker to potentially sniff details from the connection string when connectivity to third-party databases is configured to use a SQL user name and password.

Recommendations For Schneider Electric Ampla MES versions 6.4 and prior, upgrade to Ampla MES version 6.5 as soon as possible.

Fix

Insufficiently Protected Credentials

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-522

CWE-319

Related Identifiers

CVE-2017-9637

Affected Products

Ampla Mes

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-9637 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9637 · Vendor Advisory
• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05 · Note
• http://securityfocus.com/bid/99469 · Note