CVE-2017-9635

Опубликовано: 18 мая 2018

Источник: nvd

CVSS3: 3.9

CVSS2: 1.9

EPSS Низкий

Описание

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.

Ссылки

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
Vendor Advisory
http://www.securityfocus.com/bid/99469
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
Third Party Advisory
US Government Resource
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
Vendor Advisory
http://www.securityfocus.com/bid/99469
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:schneider-electric:ampla_manufacturing_execution_system:*:*:*:*:*:*:*:*

Версия до 6.4 (включая)

EPSS

Процентиль: 11%

0.00038

Низкий

3.9 Low

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-326

Связанные уязвимости

GHSA-cfpr-7wg7-7x58