CVE-2018-7841

Опубликовано: 22 мая 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Ссылки

http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/May/26
Exploit
Mailing List
Third Party Advisory
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
Vendor Advisory
http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/May/26
Exploit
Mailing List
Third Party Advisory
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7841
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:schneider-electric:u.motion_builder:1.3.4:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.5238

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-cwjr-6hc3-vpjm

CVSS3: 9.8

github

больше 3 лет назад

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

BDU:2019-02551

CVSS3: 8

fstec

почти 7 лет назад

Уязвимость системы управления производственными и жилыми объектами U.motion Builder, связанная с некорректной обработкой специальных символов в SQL-запросе, позволяющая нарушителю выполнить произвольный код