VAR-201705-3755
Vulnerability from variot - Updated: 2023-12-18 12:57An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network. Schneider Electric Wonderware Historian is a set of industrial data management software from Schneider Electric that combines high-speed data acquisition storage systems with traditional relational database management systems. A local attacker could exploit the vulnerability to access sensitive information and cause a denial of service
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201705-3755",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wonderware historian client",
"scope": "lte",
"trust": 1.0,
"vendor": "schneider electric",
"version": "2014_r2"
},
{
"model": "wonderware historian client",
"scope": "lte",
"trust": 0.8,
"vendor": "schneider electric",
"version": "2014 r2 sp1"
},
{
"model": "electric wonderware historian client r2 sp1",
"scope": "lte",
"trust": 0.6,
"vendor": "schneider",
"version": "\u003c=2014"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider electric",
"version": "2014_r2"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "9.5"
},
{
"model": "wonderware historian client r2 sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2014"
},
{
"model": "wonderware historian client r2",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2014"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.1"
},
{
"model": "wonderware historian client sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.0"
},
{
"model": "wonderware historian client sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.0"
},
{
"model": "wonderware historian client",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "10.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "wonderware historian client",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:schneider-electric:wonderware_historian_client:*:sp1:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2014_r2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Andrey Zhukov from USSC",
"sources": [
{
"db": "BID",
"id": "98254"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
],
"trust": 0.9
},
"cve": "CVE-2017-7907",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 3.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-7907",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2017-07253",
"impactScore": 9.2,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c",
"impactScore": 9.2,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 6.6,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-7907",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-7907",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-07253",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201705-227",
"trust": 0.6,
"value": "LOW"
},
{
"author": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c",
"trust": 0.2,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network. Schneider Electric Wonderware Historian is a set of industrial data management software from Schneider Electric that combines high-speed data acquisition storage systems with traditional relational database management systems. A local attacker could exploit the vulnerability to access sensitive information and cause a denial of service",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-7907",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-17-122-01",
"trust": 2.7
},
{
"db": "BID",
"id": "98254",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1038542",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2017-07253",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298",
"trust": 0.8
},
{
"db": "NSFOCUS",
"id": "36601",
"trust": 0.6
},
{
"db": "IVD",
"id": "FCB932EF-D97A-42D4-80C4-2C94B48ED73C",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"id": "VAR-201705-3755",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
}
],
"trust": 1.59166665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
}
]
},
"last_update_date": "2023-12-18T12:57:20.911000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Wonderware Historian Client XML Injection Vulnerability",
"trust": 0.8,
"url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000120/"
},
{
"title": "Patch for Wonderware Historian Client Local XML External Entity Injection Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/93992"
},
{
"title": "Schneider Electric Wonderware Historian Client Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=69853"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-611",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-122-01"
},
{
"trust": 2.2,
"url": "http://www.securityfocus.com/bid/98254"
},
{
"trust": 1.9,
"url": "http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000120/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7907"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id/1038542"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7907"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/36601"
},
{
"trust": 0.3,
"url": "http://www.schneider-electric.com/products/ww/en/"
},
{
"trust": 0.3,
"url": "https://www.wonderware.com/industrial-information-management/historian-client/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"db": "BID",
"id": "98254"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-05-23T00:00:00",
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"date": "2017-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"date": "2017-05-02T00:00:00",
"db": "BID",
"id": "98254"
},
{
"date": "2017-06-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"date": "2017-05-19T03:29:00.590000",
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"date": "2017-05-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-07253"
},
{
"date": "2017-05-18T16:17:00",
"db": "BID",
"id": "98254"
},
{
"date": "2017-06-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-004298"
},
{
"date": "2017-07-08T01:29:17.663000",
"db": "NVD",
"id": "CVE-2017-7907"
},
{
"date": "2017-05-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "98254"
},
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Wonderware Historian Client local XML External entity injection vulnerability",
"sources": [
{
"db": "IVD",
"id": "fcb932ef-d97a-42d4-80c4-2c94b48ed73c"
},
{
"db": "CNVD",
"id": "CNVD-2017-07253"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201705-227"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…