Lucene search

SchneiderCVE-2018-7772

HistoryJul 03, 2018 - 2:29 p.m.

CVE-2018-7772

2018-07-0314:29:00

CWE-89

schneider

web.nvd.nist.gov

vulnerability

schneider electric

u.motion builder

sql injection

http cookie

cve-2018-7772

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

50.0%

JSON

The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the request.

Affected configurations

Nvd

Node

schneider-electricu.motion_builderRange<1.3.4

VendorProductVersionCPE
schneider-electricu.motion_builder*cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	u.motion_builder	*	cpe:2.3:a:schneider-electric:u.motion_builder::::::::

CNA Affected

[
  {
    "product": "U.Motion",
    "vendor": "Schneider Electric SE",
    "versions": [
      {
        "status": "affected",
        "version": "U.motion Builder Software, all versions prior to v1.3.4"
      }
    ]
  }
]

References

www.schneider-electric.com/en/download/document/SEVD-2018-095-01/

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

50.0%

JSON

Related for CVE-2018-7772