Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
References
Link | Resource |
---|---|
https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/ | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: schneider
Published: 2018-05-22T00:00:00
Updated: 2018-07-03T13:57:01
Reserved: 2018-03-08T00:00:00
Link: CVE-2018-7783
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-07-03T14:29:01.477
Modified: 2022-01-31T19:43:33.913
Link: CVE-2018-7783
JSON object: View
Redhat Information
No data.
CWE