Lucene search

[email protected]CVE-2023-27981

HistoryMar 21, 2023 - 10:15 a.m.

CVE-2023-27981

2023-03-2110:15:17

CWE-22

[email protected]

web.nvd.nist.gov

cve-2023-27981

cwe-22

improper limitation

pathname

restricted directory

vulnerability

custom reports

remote code execution

igss data server

igss dashboard

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.3%

JSON

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

Affected configurations

NVD

Node

schneider-electriccustom_reportsRange≤16.0.0.23040

schneider-electricigss_dashboardRange≤16.0.0.23040

schneider-electricigss_data_serverRange≤16.0.0.23040

CPENameOperatorVersion
schneider-electric:custom_reportsschneider-electric custom reportsle16.0.0.23040
schneider-electric:igss_dashboardschneider-electric igss dashboardle16.0.0.23040
schneider-electric:igss_data_serverschneider-electric igss data serverle16.0.0.23040

CPE	Name	Operator	Version
schneider-electric:custom_reports	schneider-electric custom reports	le	16.0.0.23040
schneider-electric:igss_dashboard	schneider-electric igss dashboard	le	16.0.0.23040
schneider-electric:igss_data_server	schneider-electric igss data server	le	16.0.0.23040

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "IGSS Data Server(IGSSdataServer.exe)",
    "versions": [
      {
        "version": "V",
        "status": "affected",
        "lessThanOrEqual": "16.0.0.23040",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "IGSS Dashboard (DashBoard.exe)",
    "versions": [
      {
        "version": "V",
        "status": "affected",
        "lessThanOrEqual": "16.0.0.23040",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "Custom Reports (RMS16.dll)",
    "versions": [
      {
        "version": "V",
        "status": "affected",
        "lessThanOrEqual": "16.0.0.23040",
        "versionType": "custom"
      }
    ]
  }
]