Schneider Electric Wonderware Historian Client における XML 外部エンティティの脆弱性
| Title |
Schneider Electric Wonderware Historian Client における XML 外部エンティティの脆弱性
|
| Summary |
Schneider Electric Wonderware Historian Client には、XML 外部エンティティの脆弱性が存在します。
|
| Possible impacts |
情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
April 28, 2017, midnight |
| Registration Date |
June 21, 2017, 6:05 p.m. |
| Last Update |
June 21, 2017, 6:05 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.6
|
| Vector |
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H |
|
CVSS2.0 : 注意
|
| Score |
3.3
|
| Vector |
AV:L/AC:M/Au:N/C:P/I:N/A:P |
Affected System
| Schneider Electric |
|
Wonderware Historian Client 2014 R2 SP1 およびそれ以前
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
| No |
Changed Details |
Date of change |
| 0 |
[2017年06月21日]
掲載 |
Feb. 17, 2018, 10:37 a.m. |
NVD Vulnerability Information
CVE-2017-7907
| Summary |
An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network.
|
| Publication Date |
May 19, 2017, 12:29 p.m. |
| Registration Date |
Jan. 26, 2021, 1:29 p.m. |
| Last Update |
Nov. 21, 2024, 12:32 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:schneider-electric:wonderware_historian_client:*:sp1:*:*:*:*:*:* |
|
2014_r2 |
|
|
Related information, measures and tools
Common Vulnerabilities List