CVE-2020-7569

Published: Nov 19, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.

Affected (1)

Products: Schneider Electric: Webreports

Schneider Electric

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Webreports	From 1.9 to 3.1

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://www.se.com/ww/en/download/document/SEVD-2020-315-04/

Source: cybersecurity@se.com

PatchProductVendor Advisory

https://www.se.com/ww/en/download/document/SEVD-2020-315-04/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchProductVendor Advisory

Timeline

No history available yet.