CVE-2017-5158 - An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior

Back Back to CVE browser

CRITICAL

An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior

Published Apr 20, 2017

9.8

CRITICAL

CVSS 3.1

EPSS 2.42%

Description

An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.

Affected products

Vendor n/a Product Schneider Electric Wonderware InTouch Access Anywhere Default
n/a
- Version
  Schneider Electric Wonderware InTouch Access Anywhere
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Schneider Electric Wonderware InTouch Access Anywhere

n/a

Version	Status	Constraints
Schneider Electric Wonderware InTouch Access Anywhere	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/
x_refsource_MISCVendor Advisory
http://www.securityfocus.com/bid/97256
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01
x_refsource_MISCThird Party AdvisoryUS Government Resource

Link	Providers	Tags
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/		x_refsource_MISCVendor Advisory
http://www.securityfocus.com/bid/97256		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01		x_refsource_MISCThird Party AdvisoryUS Government Resource