Schneider Electric U.motion Builder (Update A)

🗓️ 29 Jun 2017 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 137 Views

Schneider Electric U.motion Builder (Update A) security advisory for SQL Injection, Path Traversal and more vulnerabilities in versions 1.2.1 and prior, with potential for arbitrary command execution

Reporter	Title	Published	Views	Family All 87
0day.today	Schneider Electric U.Motion Builder 1.3.4 Command Injection Vulnerability	15 May 201900:00	–	zdt
BDU FSTEC	The vulnerability of the autonomous configuration tool for the visualization and control system “U.motion Builder” arises from deficiencies in protecting the SQL query structure, allowing attackers to execute arbitrary SQL commands.	18 Aug 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the autonomous configuration tool for the visualization and control system “U.motion Builder” relates to deficiencies in path name restriction, allowing attackers to execute arbitrary code.	18 Aug 201700:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the `track_import_export.php` script of the U.motion builder system allows a perpetrator to execute arbitrary SQL queries against the database.	12 Apr 201800:00	–	bdu_fstec
Circl	CVE-2018-7765	26 Nov 202521:02	–	circl
CNVD	Schneider Electric U.motion Builder Directory Traversal Vulnerability	13 Apr 201800:00	–	cnvd
CNVD	Schneider Electric U.motion Builder Remote Code Execution Vulnerability (CNVD-2018-07819)	13 Apr 201800:00	–	cnvd
Check Point Advisories	Schneider Electric U.motion Builder css.inc.php Arbitrary File Inclusion (CVE-2017-7974)	19 Jun 201700:00	–	checkpoint_advisories
Check Point Advisories	Schneider Electric U.motion Builder loadtemplate.php SQL Injection (CVE-2017-7973)	21 Jun 201700:00	–	checkpoint_advisories
Check Point Advisories	Schneider Electric U.motion Builder runscript.php Directory Traversal (CVE-2017-7974)	27 Jun 201700:00	–	checkpoint_advisories

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-180-02.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-17-180-02
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

29 Jun 2017 00:00Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 39.8

EPSS0.04606