Lucene search

SchneiderCVELIST:CVE-2023-27984

HistoryMar 21, 2023 - 12:00 a.m.

CVE-2023-27984

2023-03-2100:00:00

CWE-20

schneider

www.cve.org

cve-2023-27984

improper input validation

custom reports

remote code execution

igss data server

igss dashboard

rms16.dll

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.1%

JSON

A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report file planted by an attacker. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "IGSS Data Server(IGSSdataServer.exe)",
    "versions": [
      {
        "version": "V",
        "status": "affected",
        "lessThanOrEqual": "16.0.0.23040",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "IGSS Dashboard (DashBoard.exe)",
    "versions": [
      {
        "version": "V",
        "status": "affected",
        "lessThanOrEqual": "16.0.0.23040",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Schneider Electric",
    "product": "Custom Reports (RMS16.dll)",
    "versions": [
      {
        "version": "V",
        "status": "affected",
        "lessThanOrEqual": "16.0.0.23040",
        "versionType": "custom"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.1%

JSON

Related for CVELIST:CVE-2023-27984