CVE-2020-7546

{"id": "CVE-2020-7546", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2020-12-01T15:15:12.563", "references": [{"url": "https://www.se.com/ww/en/download/document/SEVD-2020-287-04/", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxure\u00aa and SmartStruxure\u00aa Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage."}, {"lang": "es", "value": "Una CWE-79: Se presenta una vulnerabilidad Neutralizaci\u00f3n Inapropiada de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web en el Software EcoStruxure\u00aa y SmartStruxure\u00aa Power Monitoring and SCADA (v\u00e9ase la notificaci\u00f3n de seguridad para la informaci\u00f3n de la versi\u00f3n) que podr\u00eda permitir a un atacante llevar a cabo acciones en nombre del usuario autorizado cuando se acceder a un p\u00e1gina web afectada"}], "lastModified": "2020-12-04T20:43:43.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_energy_expert:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDF7DFC6-6F41-491B-A703-6AB0143FE5B1"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6819EA7A-C803-480F-98DF-44DA144FE488"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66E928C4-87C8-4BD6-9131-B7D558330CBA"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BEB4F4B-0B22-47CA-B173-C06C1A925348"}, {"criteria": "cpe:2.3:a:schneider-electric:power_manager:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FC0093C-00CE-43A8-80EC-0509992E637B"}, {"criteria": "cpe:2.3:a:schneider-electric:power_manager:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE9A1DF0-42B8-4123-8276-1D4BED156034"}, {"criteria": "cpe:2.3:a:schneider-electric:power_manager:1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54A54A8D-40F5-4E75-A524-B81E487DB274"}, {"criteria": "cpe:2.3:a:schneider-electric:powerscada_expert_with_advanced_reporting_and_dashboards:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CC2CF9D-8D0C-4FD3-94A2-34A63E297B81"}, {"criteria": "cpe:2.3:a:schneider-electric:powerscada_operation_with_advanced_reporting_and_dashboards:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC8F406C-868A-443C-8842-6CFFFF17C236"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}