Lucene search

[email protected]CVE-2023-27977

HistoryMar 21, 2023 - 12:15 p.m.

CVE-2023-27977

2023-03-2112:15:10

CWE-345

[email protected]

web.nvd.nist.gov

cve-2023-27977

cwe-345

igss data server

file deletion

crafted messages

data authenticity

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.9 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

44.8%

JSON

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss of data when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

CPENameOperatorVersion
schneider-electric:custom_reportsschneider-electric custom reportsle16.0.0.23040
schneider-electric:custom_reportsschneider-electric custom reportseq16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardle16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardeq16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardeq-
schneider-electric:igss_data_serverschneider-electric igss data serverle16.0.0.23040
schneider-electric:igss_data_serverschneider-electric igss data servereq16.0.0.23040
schneider-electric:igss_data_serverschneider-electric igss data servereq15.0.0.22170

CPE	Name	Operator	Version
schneider-electric:custom_reports	schneider-electric custom reports	le	16.0.0.23040
schneider-electric:custom_reports	schneider-electric custom reports	eq	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	le	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	eq	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	eq	-
schneider-electric:igss_data_server	schneider-electric igss data server	le	16.0.0.23040
schneider-electric:igss_data_server	schneider-electric igss data server	eq	16.0.0.23040
schneider-electric:igss_data_server	schneider-electric igss data server	eq	15.0.0.22170

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.9 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

44.8%

JSON

Related for CVE-2023-27977

cvelist1 cnvd1 prion1 zdi1 ics1