CVE-2017-7970

{"id": "CVE-2017-7970", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2017-09-26T01:29:03.537", "references": [{"url": "http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "http://www.securityfocus.com/bid/99913", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cybersecurity@se.com"}, {"url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere", "tags": ["Issue Tracking", "Mitigation", "Patch", "Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server components."}, {"lang": "es", "value": "Existe una vulnerabilidad en la versi\u00f3n 1.0 de PowerSCADA Anywhere de Schneider Electric redistribuida con PowerSCADA Expert 8.1, PowerSCADA Expert 8.2 y Citect Anywhere 1.0 que permite que se especifiquen nodos de destino del servidor arbitrarios en peticiones de conexi\u00f3n a los componentes de Secure Gateway y Server."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:powerscada_anywhere:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6445511E-70B8-4E03-A178-FFDBE02E1609"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:powerscada_expert:8.1:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AE171A71-B1AF-471B-9D27-07D4491D05B3"}, {"criteria": "cpe:2.3:a:schneider-electric:powerscada_expert:8.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D2A3FA74-D201-41AA-BDA1-82816813AD11"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:citect_anywhere:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5182F21D-1DF5-492A-9A3D-B913AC6B12F6"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}