CVE-2018-7771

2018-07-0314:00:00

schneider

www.cve.org

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

38.3%

JSON

The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.

CNA Affected

[
  {
    "product": "U.Motion",
    "vendor": "Schneider Electric SE",
    "versions": [
      {
        "status": "affected",
        "version": "U.motion Builder Software, all versions prior to v1.3.4"
      }
    ]
  }
]

References

www.schneider-electric.com/en/download/document/SEVD-2018-095-01/