CVE-2013-0685

2022-10-0316:15:05

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-0685

invensys wonderware

information server

wis

remote attack

arbitrary code

denial of service

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.4%

JSON

Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors.

Affected configurations

NVD

Node

invensyswonderware_information_serverMatch4.0sp1sp1

invensyswonderware_information_serverMatch4.5-portal

invensyswonderware_information_serverMatch5.0-portal

CPENameOperatorVersion
invensys:wonderware_information_serverinvensys wonderware information servereq4.0
invensys:wonderware_information_serverinvensys wonderware information servereq4.5
invensys:wonderware_information_serverinvensys wonderware information servereq5.0

CPE	Name	Operator	Version
invensys:wonderware_information_server	invensys wonderware information server	eq	4.0
invensys:wonderware_information_server	invensys wonderware information server	eq	4.5
invensys:wonderware_information_server	invensys wonderware information server	eq	5.0