CVE-2014-5399

2014-08-2801:55:03

CWE-89

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.3

Confidence

Low

EPSS

0.001

Percentile

49.6%

JSON

SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected configurations

Nvd

Node

invensyswonderware_information_serverMatch4.0sp1

invensyswonderware_information_serverMatch4.0sp1portal

invensyswonderware_information_serverMatch4.5-portal

invensyswonderware_information_serverMatch5.0-portal

invensyswonderware_information_serverMatch5.5portal

VendorProductVersionCPE
invensyswonderware_information_server4.0cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:*:*:*:*:*:*
invensyswonderware_information_server4.0cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:*:*:portal:*:*:*
invensyswonderware_information_server4.5cpe:2.3:a:invensys:wonderware_information_server:4.5:-:portal:*:*:*:*:*
invensyswonderware_information_server5.0cpe:2.3:a:invensys:wonderware_information_server:5.0:-:portal:*:*:*:*:*
invensyswonderware_information_server5.5cpe:2.3:a:invensys:wonderware_information_server:5.5:*:*:*:portal:*:*:*

Vendor	Product	Version	CPE
invensys	wonderware_information_server	4.0	cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1::::::
invensys	wonderware_information_server	4.0	cpe:2.3:a:invensys:wonderware_information_server:4.0:sp1:::portal:::*
invensys	wonderware_information_server	4.5	cpe:2.3:a:invensys:wonderware_information_server:4.5:-:portal:::::*
invensys	wonderware_information_server	5.0	cpe:2.3:a:invensys:wonderware_information_server:5.0:-:portal:::::*
invensys	wonderware_information_server	5.5	cpe:2.3:a:invensys:wonderware_information_server:5.5::::portal:::