Lucene search

[email protected]CVE-2023-27979

HistoryMar 21, 2023 - 1:15 p.m.

CVE-2023-27979

2023-03-2113:15:12

CWE-345

[email protected]

web.nvd.nist.gov

cve-2023-27979

igss data server

file renaming

denial of service

vulnerability

nvd

cwe-345

insufficient verification of data authenticity

data server

igss dashboard

custom reports

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

6.5 Medium

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.002 Low

EPSS

Percentile

52.6%

JSON

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial of service when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

CPENameOperatorVersion
schneider-electric:custom_reportsschneider-electric custom reportsle16.0.0.23040
schneider-electric:custom_reportsschneider-electric custom reportseq16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardle16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardeq16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardeq-
schneider-electric:igss_data_serverschneider-electric igss data serverle16.0.0.23040
schneider-electric:igss_data_serverschneider-electric igss data servereq16.0.0.23040
schneider-electric:igss_data_serverschneider-electric igss data servereq15.0.0.22170

CPE	Name	Operator	Version
schneider-electric:custom_reports	schneider-electric custom reports	le	16.0.0.23040
schneider-electric:custom_reports	schneider-electric custom reports	eq	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	le	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	eq	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	eq	-
schneider-electric:igss_data_server	schneider-electric igss data server	le	16.0.0.23040
schneider-electric:igss_data_server	schneider-electric igss data server	eq	16.0.0.23040
schneider-electric:igss_data_server	schneider-electric igss data server	eq	15.0.0.22170

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

6.5 Medium

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.002 Low

EPSS

Percentile

52.6%

JSON

Related for CVE-2023-27979

cvelist1 prion1 zdi1 cnvd1 ics1