{"containers": {"cna": {"affected": [{"product": "\u00a0EcoStruxure Power Build - Rapsody software V2.1.13 and prior.\u00a0", "vendor": "n/a", "versions": [{"status": "affected", "version": "EcoStruxure Power Build - Rapsody software V2.1.13 and prior."}]}], "descriptions": [{"lang": "en", "value": "A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "\u00a0CWE-434: Unrestricted Upload of File with Dangerous Type\u00a0", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-18T17:58:44", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-02/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-187/"}, {"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2021-22698", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "\u00a0EcoStruxure Power Build - Rapsody software V2.1.13 and prior.\u00a0", "version": {"version_data": [{"version_value": "EcoStruxure Power Build - Rapsody software V2.1.13 and prior."}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "\u00a0CWE-434: Unrestricted Upload of File with Dangerous Type\u00a0"}]}]}, "references": {"reference_data": [{"name": "https://www.se.com/ww/en/download/document/SEVD-2021-012-02/", "refsource": "MISC", "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-02/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-187/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-187/"}, {"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01"}]}}}}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2021-22698", "datePublished": "2021-01-25T17:10:12", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2021-03-18T17:58:44", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody:*:*:*:*:*:*:*:*", "matchCriteriaId": "E458DE1E-6488-4F4A-BD96-7E46DA716BC5", "versionEndIncluding": "2.1.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed."}, {"lang": "es", "value": "CWE-434: Se presenta una vulnerabilidad de Carga Sin Restricciones de Archivo con Tipo Peligroso en el software EcoStruxure Power Build - Rapsody (versiones V2.1.13 y anteriores) que podr\u00eda permitir que ocurra un desbordamiento del b\u00fafer en la regi\u00f3n stack de la memoria que podr\u00eda resultar en una ejecuci\u00f3n de c\u00f3digo remota cuando un archivo SSD es cargado y analizado inapropiadamente"}], "id": "CVE-2021-22698", "lastModified": "2022-01-31T19:33:27.337", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-01-26T18:16:18.927", "references": [{"source": "cybersecurity@se.com", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01"}, {"source": "cybersecurity@se.com", "tags": ["Vendor Advisory"], "url": "https://www.se.com/ww/en/download/document/SEVD-2021-012-02/"}, {"source": "cybersecurity@se.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-187/"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "cybersecurity@se.com", "type": "Primary"}]}

{}