VAR-201704-0597
Vulnerability from variot - Updated: 2023-12-18 12:44An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified. Schneider Electric Wonderware InTouch is an open, scalable HMI and SCADA monitoring solution from Schneider Electric, France, which creates standardized, reusable visualization applications. Wonderware InTouch Access Anywhere is a product that provides access to InTouch applications through a web browser. An attacker could exploit the vulnerability to obtain a certificate with the help of a URL parameter. A successful exploit may allow an attacker to obtain sensitive information, and perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201704-0597",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wonderware intouch access anywhere",
"scope": "lte",
"trust": 1.0,
"vendor": "aveva",
"version": "11.5.2"
},
{
"model": "wonderware intouch access anywhere 2014",
"scope": "lte",
"trust": 0.8,
"vendor": "schneider electric",
"version": "r2 sp1b (11.5.2)"
},
{
"model": "electric wonderware intouch access anywhere",
"scope": "lte",
"trust": 0.6,
"vendor": "schneider",
"version": "\u003c=11.5.2"
},
{
"model": "wonderware intouch access anywhere 2014",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider electric",
"version": "11.5.2"
},
{
"model": "wonderware intouch access anywhere",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "11.5.2"
},
{
"model": "wonderware intouch access anywhere",
"scope": "ne",
"trust": 0.3,
"vendor": "schneider electric",
"version": "17.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "wonderware intouch access anywhere 2014",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "BID",
"id": "97256"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:aveva:wonderware_intouch_access_anywhere:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "11.5.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-5158"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ruslan Habalov and Jan Bee of the Google ISA Assessments Team",
"sources": [
{
"db": "BID",
"id": "97256"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
],
"trust": 0.9
},
"cve": "CVE-2017-5158",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-5158",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-05157",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "30233a00-4cc0-473a-9235-b883e95bb33b",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-5158",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-5158",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2017-05157",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201703-1438",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified. Schneider Electric Wonderware InTouch is an open, scalable HMI and SCADA monitoring solution from Schneider Electric, France, which creates standardized, reusable visualization applications. Wonderware InTouch Access Anywhere is a product that provides access to InTouch applications through a web browser. An attacker could exploit the vulnerability to obtain a certificate with the help of a URL parameter. \nA successful exploit may allow an attacker to obtain sensitive information, and perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "BID",
"id": "97256"
},
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-5158",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-17-089-01",
"trust": 2.7
},
{
"db": "BID",
"id": "97256",
"trust": 2.5
},
{
"db": "CNVD",
"id": "CNVD-2017-05157",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245",
"trust": 0.8
},
{
"db": "IVD",
"id": "30233A00-4CC0-473A-9235-B883E95BB33B",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "BID",
"id": "97256"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"id": "VAR-201704-0597",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
}
],
"trust": 1.675
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
}
]
},
"last_update_date": "2023-12-18T12:44:39.593000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Wonderware Security Bulletin LFSEC00000114",
"trust": 0.8,
"url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/"
},
{
"title": "Schneider Electric Wonderware InTouch Access Anywhere Information Disclosure Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/92492"
},
{
"title": "Schneider Electric Wonderware InTouch Access Anywhere Repair measures for information disclosure vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=68928"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "NVD",
"id": "CVE-2017-5158"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-089-01"
},
{
"trust": 2.2,
"url": "http://www.securityfocus.com/bid/97256"
},
{
"trust": 1.6,
"url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5158"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-5158"
},
{
"trust": 0.3,
"url": "http://www.schneider-electric.com/products/ww/en/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "BID",
"id": "97256"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "BID",
"id": "97256"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-24T00:00:00",
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"date": "2017-04-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"date": "2017-03-31T00:00:00",
"db": "BID",
"id": "97256"
},
{
"date": "2017-05-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"date": "2017-04-20T20:59:00.440000",
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"date": "2017-03-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"date": "2017-04-04T00:02:00",
"db": "BID",
"id": "97256"
},
{
"date": "2017-05-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-003245"
},
{
"date": "2021-09-09T13:31:32.243000",
"db": "NVD",
"id": "CVE-2017-5158"
},
{
"date": "2021-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Electric Wonderware InTouch Access Anywhere Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "30233a00-4cc0-473a-9235-b883e95bb33b"
},
{
"db": "CNVD",
"id": "CNVD-2017-05157"
},
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201703-1438"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…