PT-2020-5823 · Schneider Electric · Ecostruxure Building Operation Webreports

Published 2020-11-10 · Updated 2022-01-31 · CVE-2020-7572

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1

Description: A vulnerability exists due to improper restriction of XML external entity references, allowing an authenticated remote user to inject arbitrary XML code. This could lead to disclosure of confidential data, denial of service, or server-side request forgery due to the improper configuration of the XML parser.

Recommendations: For versions 1.9 through 3.1, update the XML parser configuration to properly restrict XML external entity references. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-01792

CVE-2020-7572

Affected Products

Ecostruxure Building Operation Webreports

References · 7

• https://se.com/ww/en/download/document/SEVD-2020-315-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7572 · Security Note
• https://bdu.fstec.ru/vul/2021-01792 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7572 · Vendor Advisory
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-315-04_EcoStruxure%E2%84%A2_Building_Operation_Security_Notification.pdf&p_Doc_Ref=SEVD-2020-315-04 · Note
• https://t.me/cvenotify/5842 · Telegram Post
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-315-04_EcoStruxure%E2%84%A2_Building_Operation_Security_Notification.pdf&p_Doc_Ref=SEVD-2020-315-04 · Note