CVE-2017-9637

Опубликовано: 18 мая 2018

Источник: nvd

CVSS3: 4.1

CVSS2: 1.9

EPSS Низкий

Описание

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.

Ссылки

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
Vendor Advisory
http://www.securityfocus.com/bid/99469
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
Third Party Advisory
US Government Resource
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000118/
Vendor Advisory
http://www.securityfocus.com/bid/99469
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-05
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:schneider-electric:ampla_manufacturing_execution_system:*:*:*:*:*:*:*:*

Версия до 6.4 (включая)

EPSS

Процентиль: 9%

0.00033

Низкий

4.1 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-319

CWE-522

Связанные уязвимости

GHSA-95r6-hq2x-fm98