Search criteria
6 vulnerabilities by ARC Informatique
CVE-2022-4312 (GCVE-0-2022-4312)
Vulnerability from cvelistv5 – Published: 2022-12-12 17:10 – Updated: 2025-04-14 18:00
VLAI?
Summary
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could
allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files
to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.
Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email
account and SIM card.
Severity ?
5.5 (Medium)
CWE
- CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ARC Informatique | PcVue |
Affected:
8.10 , ≤ 15.2.3
(custom)
|
Credits
ARC Informatique
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:34:50.159Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1171-security-bulletin-2022-7"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4312",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:44:58.764003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T18:00:16.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PcVue",
"vendor": "ARC Informatique",
"versions": [
{
"lessThanOrEqual": "15.2.3",
"status": "affected",
"version": "8.10",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "ARC Informatique"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nA cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could\nallow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files\nto discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.\nSuccessful exploitation of this vulnerability could allow an unauthorized user access to the underlying email\naccount and SIM card.\n\n"
}
],
"value": "\nA cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could\nallow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files\nto discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.\nSuccessful exploitation of this vulnerability could allow an unauthorized user access to the underlying email\naccount and SIM card.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T17:10:22.202Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1171-security-bulletin-2022-7"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-4312",
"datePublished": "2022-12-12T17:10:22.202Z",
"dateReserved": "2022-12-06T19:08:58.863Z",
"dateUpdated": "2025-04-14T18:00:16.760Z",
"requesterUserId": "4bacbe59-ded0-410b-af09-0c6f387b5ddc",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-4311 (GCVE-0-2022-4311)
Vulnerability from cvelistv5 – Published: 2022-12-12 17:08 – Updated: 2025-04-14 17:59
VLAI?
Summary
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This
could allow a user with access to the log files to discover connection strings of data sources configured for the
DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users
unauthorized access to the underlying data sources.
Severity ?
4.7 (Medium)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ARC Informatique | PcVue |
Affected:
15 , ≤ 15.2.2
(custom)
|
Credits
ARC Informatique
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:34:50.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T14:51:25.883186Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T17:59:59.779Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PcVue",
"vendor": "ARC Informatique",
"versions": [
{
"lessThanOrEqual": "15.2.2",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "ARC Informatique"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nAn insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This\ncould allow a user with access to the log files to discover connection strings of data sources configured for the\nDbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users\nunauthorized access to the underlying data sources.\n\n"
}
],
"value": "\nAn insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This\ncould allow a user with access to the log files to discover connection strings of data sources configured for the\nDbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users\nunauthorized access to the underlying data sources.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T17:08:30.847Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-4311",
"datePublished": "2022-12-12T17:08:30.847Z",
"dateReserved": "2022-12-06T19:08:45.932Z",
"dateUpdated": "2025-04-14T17:59:59.779Z",
"requesterUserId": "4bacbe59-ded0-410b-af09-0c6f387b5ddc",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2569 (GCVE-0-2022-2569)
Vulnerability from cvelistv5 – Published: 2022-08-24 15:16 – Updated: 2025-04-16 16:11
VLAI?
Summary
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
Severity ?
5.5 (Medium)
CWE
- CWE-312 - Cleartext Storage of Sensitive Information
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ARC Informatique | PcVue 12 OAuth web service configuration |
Affected:
All , < 12.0.27
(custom)
|
|||||||
|
|||||||||
Credits
An unnamed researcher reported this vulnerability to ARC Informatique.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:39:08.065Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-2569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:50:26.795107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:11:59.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "PcVue 12 OAuth web service configuration",
"vendor": "ARC Informatique",
"versions": [
{
"lessThan": "12.0.27",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"product": "PcVue 15 OAuth web service configuration",
"vendor": "ARC Informatique",
"versions": [
{
"status": "affected",
"version": "All"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "An unnamed researcher reported this vulnerability to ARC Informatique."
}
],
"datePublic": "2022-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-24T15:16:15.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0"
}
],
"solutions": [
{
"lang": "en",
"value": "PcVue 12: The fix is available in Maintenance release 12.0.27\nAfter installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. \nAll users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file."
}
],
"source": {
"advisory": "ICSA-22-235-01",
"discovery": "UNKNOWN"
},
"title": "ARC Informatique PcVue",
"workarounds": [
{
"lang": "en",
"value": "ARC Informatique has identified additional steps users can apply to reduce the risk:\n\nUninstall the Web Server\nAll users not using the affected component should uninstall the web server. The OAuth web service and its configuration are part of the Web Server for PcVue. If the system does not require Web \u0026 Mobile features, then users should not install them.\nUsers should contact ARC Informatique\u2019s PcVue Solutions for assistance with the above steps.\n\nFor additional information, visit the public ARC Informatique security alert page."
},
{
"lang": "en",
"value": "PcVue 15 does not have a fix released yet, but is in the works."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2022-08-23T17:00:00.000Z",
"ID": "CVE-2022-2569",
"STATE": "PUBLIC",
"TITLE": "ARC Informatique PcVue"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PcVue 12 OAuth web service configuration",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "12.0.27"
}
]
}
},
{
"product_name": "PcVue 15 OAuth web service configuration",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "All",
"version_value": "All"
}
]
}
}
]
},
"vendor_name": "ARC Informatique"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "An unnamed researcher reported this vulnerability to ARC Informatique."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-312 Cleartext Storage of Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0"
}
]
},
"solution": [
{
"lang": "en",
"value": "PcVue 12: The fix is available in Maintenance release 12.0.27\nAfter installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. \nAll users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file."
}
],
"source": {
"advisory": "ICSA-22-235-01",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "ARC Informatique has identified additional steps users can apply to reduce the risk:\n\nUninstall the Web Server\nAll users not using the affected component should uninstall the web server. The OAuth web service and its configuration are part of the Web Server for PcVue. If the system does not require Web \u0026 Mobile features, then users should not install them.\nUsers should contact ARC Informatique\u2019s PcVue Solutions for assistance with the above steps.\n\nFor additional information, visit the public ARC Informatique security alert page."
},
{
"lang": "en",
"value": "PcVue 15 does not have a fix released yet, but is in the works."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-2569",
"datePublished": "2022-08-24T15:16:15.430Z",
"dateReserved": "2022-07-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:11:59.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-26867 (GCVE-0-2020-26867)
Vulnerability from cvelistv5 – Published: 2020-10-12 13:54 – Updated: 2024-09-16 22:16
VLAI?
Summary
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
Severity ?
9.8 (Critical)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ARC Informatique | PcVue |
Affected:
unspecified , ≤ 12.0.17
(custom)
|
Credits
Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:03:22.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PcVue",
"vendor": "ARC Informatique",
"versions": [
{
"lessThanOrEqual": "12.0.17",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique."
}
],
"datePublic": "2020-11-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-11T15:15:36",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.pcvuesolutions.com/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
}
],
"solutions": [
{
"lang": "en",
"value": "ARC Informatique recommends upgrading PcVue to v12.0.17. Contact PcVue Support to receive instructions on downloading and installing the latest software version."
}
],
"source": {
"advisory": "ICSA-20-308-03",
"discovery": "UNKNOWN"
},
"title": "ARC Informatique PcVue Deserialization of Untrusted Data",
"workarounds": [
{
"lang": "en",
"value": "The following mitigations and workarounds have been identified by ARC Informatique to help reduce risk:\n\nUninstall the web and mobile backend. Users not using the affected components should uninstall them. If the components are not required, do not install them.\nChange default configuration if using components prior to v12.0. If taking advantage of the web and mobile back features with a product version up to v11.2, change the following configuration item manually to prevent remote code execution\nIn the file \u003cPcVue installation directory\u003e\\Bin\\PropertyServer.config\u003e, change the following element and set it to \u201cLow\u201d (defaults to \u201cFull\u201d):\n \u003cserverProviders\u003e\n \u003cformatter ref=\u201dbinary\u201d typeFilterLevel=\u201dLow\u201d /\u003e\n \u003c/serverProviders\u003e\n\n \nThis workaround cannot be applied to PcVue v12.0\nHarden firewall configuration by ensuring that incoming connections on the corresponding port are authorized only if initiated by the IIS Web Server process. The listening port is configurable (default 8090) and may have been changed on the system using the Application Explorer."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2020-11-03T00:00:00.000Z",
"ID": "CVE-2020-26867",
"STATE": "PUBLIC",
"TITLE": "ARC Informatique PcVue Deserialization of Untrusted Data"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PcVue",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "12.0.17"
}
]
}
}
]
},
"vendor_name": "ARC Informatique"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502: Deserialization of Untrusted Data"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"name": "https://www.pcvuesolutions.com/security",
"refsource": "CONFIRM",
"url": "https://www.pcvuesolutions.com/security"
},
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/",
"refsource": "CONFIRM",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/"
},
{
"name": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1",
"refsource": "CONFIRM",
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
}
]
},
"solution": [
{
"lang": "en",
"value": "ARC Informatique recommends upgrading PcVue to v12.0.17. Contact PcVue Support to receive instructions on downloading and installing the latest software version."
}
],
"source": {
"advisory": "ICSA-20-308-03",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "The following mitigations and workarounds have been identified by ARC Informatique to help reduce risk:\n\nUninstall the web and mobile backend. Users not using the affected components should uninstall them. If the components are not required, do not install them.\nChange default configuration if using components prior to v12.0. If taking advantage of the web and mobile back features with a product version up to v11.2, change the following configuration item manually to prevent remote code execution\nIn the file \u003cPcVue installation directory\u003e\\Bin\\PropertyServer.config\u003e, change the following element and set it to \u201cLow\u201d (defaults to \u201cFull\u201d):\n \u003cserverProviders\u003e\n \u003cformatter ref=\u201dbinary\u201d typeFilterLevel=\u201dLow\u201d /\u003e\n \u003c/serverProviders\u003e\n\n \nThis workaround cannot be applied to PcVue v12.0\nHarden firewall configuration by ensuring that incoming connections on the corresponding port are authorized only if initiated by the IIS Web Server process. The listening port is configurable (default 8090) and may have been changed on the system using the Application Explorer."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2020-26867",
"datePublished": "2020-10-12T13:54:47.081903Z",
"dateReserved": "2020-10-07T00:00:00",
"dateUpdated": "2024-09-16T22:16:02.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-26869 (GCVE-0-2020-26869)
Vulnerability from cvelistv5 – Published: 2020-10-12 13:52 – Updated: 2024-09-17 02:16
VLAI?
Summary
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
Severity ?
7.5 (High)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ARC Informatique | PcVue |
Affected:
unspecified , ≤ 12.0.17
(custom)
|
Credits
Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:03:22.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PcVue",
"vendor": "ARC Informatique",
"versions": [
{
"lessThanOrEqual": "12.0.17",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique."
}
],
"datePublic": "2020-11-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-11T15:15:21",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.pcvuesolutions.com/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
}
],
"solutions": [
{
"lang": "en",
"value": "ARC Informatique recommends upgrading PcVue to v12.0.17. Contact PcVue Support to receive instructions on downloading and installing the latest software version."
}
],
"source": {
"advisory": "ICSA-20-308-03",
"discovery": "UNKNOWN"
},
"title": "ARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized Actor",
"workarounds": [
{
"lang": "en",
"value": "The following mitigations and workarounds have been identified by ARC Informatique to help reduce risk:\n\nUninstall the web and mobile backend. Users not using the affected components should uninstall them. If the components are not required, do not install them.\nChange default configuration if using components prior to v12.0. If taking advantage of the web and mobile back features with a product version up to v11.2, change the following configuration item manually to prevent remote code execution\nIn the file \u003cPcVue installation directory\u003e\\Bin\\PropertyServer.config\u003e, change the following element and set it to \u201cLow\u201d (defaults to \u201cFull\u201d):\n \u003cserverProviders\u003e\n \u003cformatter ref=\u201dbinary\u201d typeFilterLevel=\u201dLow\u201d /\u003e\n \u003c/serverProviders\u003e\n\n \nThis workaround cannot be applied to PcVue v12.0\nHarden firewall configuration by ensuring that incoming connections on the corresponding port are authorized only if initiated by the IIS Web Server process. The listening port is configurable (default 8090) and may have been changed on the system using the Application Explorer."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2020-11-03T00:00:00.000Z",
"ID": "CVE-2020-26869",
"STATE": "PUBLIC",
"TITLE": "ARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized Actor"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PcVue",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "12.0.17"
}
]
}
}
]
},
"vendor_name": "ARC Informatique"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"name": "https://www.pcvuesolutions.com/security",
"refsource": "CONFIRM",
"url": "https://www.pcvuesolutions.com/security"
},
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/",
"refsource": "CONFIRM",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/"
},
{
"name": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1",
"refsource": "CONFIRM",
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
}
]
},
"solution": [
{
"lang": "en",
"value": "ARC Informatique recommends upgrading PcVue to v12.0.17. Contact PcVue Support to receive instructions on downloading and installing the latest software version."
}
],
"source": {
"advisory": "ICSA-20-308-03",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "The following mitigations and workarounds have been identified by ARC Informatique to help reduce risk:\n\nUninstall the web and mobile backend. Users not using the affected components should uninstall them. If the components are not required, do not install them.\nChange default configuration if using components prior to v12.0. If taking advantage of the web and mobile back features with a product version up to v11.2, change the following configuration item manually to prevent remote code execution\nIn the file \u003cPcVue installation directory\u003e\\Bin\\PropertyServer.config\u003e, change the following element and set it to \u201cLow\u201d (defaults to \u201cFull\u201d):\n \u003cserverProviders\u003e\n \u003cformatter ref=\u201dbinary\u201d typeFilterLevel=\u201dLow\u201d /\u003e\n \u003c/serverProviders\u003e\n\n \nThis workaround cannot be applied to PcVue v12.0\nHarden firewall configuration by ensuring that incoming connections on the corresponding port are authorized only if initiated by the IIS Web Server process. The listening port is configurable (default 8090) and may have been changed on the system using the Application Explorer."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2020-26869",
"datePublished": "2020-10-12T13:52:50.268076Z",
"dateReserved": "2020-10-07T00:00:00",
"dateUpdated": "2024-09-17T02:16:16.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-26868 (GCVE-0-2020-26868)
Vulnerability from cvelistv5 – Published: 2020-10-12 13:50 – Updated: 2024-09-17 00:31
VLAI?
Summary
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit.
Severity ?
7.5 (High)
CWE
- CWE-767 - Access to Critical Private Variable via Public Method
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ARC Informatique | PcVue |
Affected:
unspecified , ≤ 12.0.17
(custom)
|
Credits
Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:03:22.524Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/security"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "PcVue",
"vendor": "ARC Informatique",
"versions": [
{
"lessThanOrEqual": "12.0.17",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique."
}
],
"datePublic": "2020-11-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-767",
"description": "CWE-767: Access to Critical Private Variable via Public Method",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-11T15:15:29",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.pcvuesolutions.com/security"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
}
],
"solutions": [
{
"lang": "en",
"value": "ARC Informatique recommends upgrading PcVue to v12.0.17. Contact PcVue Support to receive instructions on downloading and installing the latest software version."
}
],
"source": {
"advisory": "ICSA-20-308-03",
"discovery": "UNKNOWN"
},
"title": "ARC Informatique PcVue Access to Critical Private Variable via Public Method",
"workarounds": [
{
"lang": "en",
"value": "The following mitigations and workarounds have been identified by ARC Informatique to help reduce risk:\n\nUninstall the web and mobile backend. Users not using the affected components should uninstall them. If the components are not required, do not install them.\nChange default configuration if using components prior to v12.0. If taking advantage of the web and mobile back features with a product version up to v11.2, change the following configuration item manually to prevent remote code execution\nIn the file \u003cPcVue installation directory\u003e\\Bin\\PropertyServer.config\u003e, change the following element and set it to \u201cLow\u201d (defaults to \u201cFull\u201d):\n \u003cserverProviders\u003e\n \u003cformatter ref=\u201dbinary\u201d typeFilterLevel=\u201dLow\u201d /\u003e\n \u003c/serverProviders\u003e\n\n \nThis workaround cannot be applied to PcVue v12.0\nHarden firewall configuration by ensuring that incoming connections on the corresponding port are authorized only if initiated by the IIS Web Server process. The listening port is configurable (default 8090) and may have been changed on the system using the Application Explorer."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vulnerability@kaspersky.com",
"DATE_PUBLIC": "2020-11-03T00:00:00.000Z",
"ID": "CVE-2020-26868",
"STATE": "PUBLIC",
"TITLE": "ARC Informatique PcVue Access to Critical Private Variable via Public Method"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "PcVue",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "12.0.17"
}
]
}
}
]
},
"vendor_name": "ARC Informatique"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Sergey Temnikov and Andrey Muravitsky of Kaspersky Lab reported these vulnerabilities to ARC Informatique."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-767: Access to Critical Private Variable via Public Method"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
},
{
"name": "https://www.pcvuesolutions.com/security",
"refsource": "CONFIRM",
"url": "https://www.pcvuesolutions.com/security"
},
{
"name": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/",
"refsource": "CONFIRM",
"url": "https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/"
},
{
"name": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1",
"refsource": "CONFIRM",
"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03"
}
]
},
"solution": [
{
"lang": "en",
"value": "ARC Informatique recommends upgrading PcVue to v12.0.17. Contact PcVue Support to receive instructions on downloading and installing the latest software version."
}
],
"source": {
"advisory": "ICSA-20-308-03",
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "The following mitigations and workarounds have been identified by ARC Informatique to help reduce risk:\n\nUninstall the web and mobile backend. Users not using the affected components should uninstall them. If the components are not required, do not install them.\nChange default configuration if using components prior to v12.0. If taking advantage of the web and mobile back features with a product version up to v11.2, change the following configuration item manually to prevent remote code execution\nIn the file \u003cPcVue installation directory\u003e\\Bin\\PropertyServer.config\u003e, change the following element and set it to \u201cLow\u201d (defaults to \u201cFull\u201d):\n \u003cserverProviders\u003e\n \u003cformatter ref=\u201dbinary\u201d typeFilterLevel=\u201dLow\u201d /\u003e\n \u003c/serverProviders\u003e\n\n \nThis workaround cannot be applied to PcVue v12.0\nHarden firewall configuration by ensuring that incoming connections on the corresponding port are authorized only if initiated by the IIS Web Server process. The listening port is configurable (default 8090) and may have been changed on the system using the Application Explorer."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2020-26868",
"datePublished": "2020-10-12T13:50:37.117523Z",
"dateReserved": "2020-10-07T00:00:00",
"dateUpdated": "2024-09-17T00:31:32.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}