CVE-2017-9964

🗓️ 02 Jan 2018 03:00:00Reported by schneiderType

cve🔗 web.nvd.nist.gov👁 46 Views🌐 WEB

Path Traversal in Schneider Electric Pelco VideoXpert Enterprise, CVE-2017-996

Reporter	Title	Published	Views	Family All 9
CNVD	Schneider Electric Pelco VideoXpert Enterprise Directory Traversal Vulnerability	28 Dec 201700:00	–	cnvd
Cvelist	CVE-2017-9964	2 Jan 201803:00	–	cvelist
EUVD	EUVD-2017-18873	7 Oct 202500:30	–	euvd
ICS	Schneider Electric Pelco VideoXpert Enterprise	21 Dec 201700:00	–	ics
NVD	CVE-2017-9964	2 Jan 201803:29	–	nvd
OpenVAS	Pelco VideoXpert Multiple Vulnerabilities	11 Jul 201700:00	–	openvas
OSV	CVE-2017-9964	2 Jan 201803:29	–	osv
Prion	Path traversal	2 Jan 201803:29	–	prion
Zero Science Lab	Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information	10 Jul 201700:00	–	zeroscience

NVD

Node

schneider-electric pelco_videoxpertRange<2.1enterprise

[
  {
    "product": "Pelco VideoXpert Enterprise",
    "vendor": "Schneider Electric SE",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 2.0 and prior"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/102338
schneider-electric	www.schneider-electric.com/en/download/document/SEVD-2017-339-01/
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-17-355-02

Parameter	Position	Path	Description	CWE
auth_token	query param	/portal/System.html?auth_token=ZXlKMWMyVnlibUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmpFeU15SXNJbVJ2YldGcGJpSTZJa3hQUTBGTUlpd2laWGh3YVhKbGN5STZNVFE1TVRVMU5qYzVOekUxT0N3aVlXZGxiblFpT2lJME1HWTJORE00TmkxbVptTXdMVFExTkRFdE9XTmpaQzFoTlRJeU0yUmlNbVpqTURraUxDSmpiR2xsYm5SSmNDSTZJakV5Tnk0d0xqQXVNU0o5	Directory traversal leading to reading vxcore.log and authentication bypass / session hijack via leaked auth_token.	CWE-22

21 Nov 2024 03:37Current

6.9Medium risk

Vulners AI Score6.9

CVSS 25.8

CVSS 36.9

EPSS0.00693

CWE-22