Schneider Electric SE U.Motion
En bref
- Source
- NVD
- EPSS
- EPSS 1.47 % · centile 74 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- schneider
- Statut NVD
- Modified
Description
A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.
Faiblesses (CWE)
- CWE-89 — Injection SQL
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-16943
- GCVE · GCVE-0-2017-7973
Configurations affectées (CPE NVD)
cpe:2.3:a:schneider-electric:u.motion_builder:*:*:*:*:*:*:*:*≤ 1.2.1
Produits affectés
| Produit | Versions |
|---|---|
| Schneider Electric SE · U.Motion | affected U.motion Builder Versions 1.2.1 and prior. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |