ICSA-17-180-02: Schneider Electric U.motion Builder (Update A)
Unauthenticated users can use calls to various paths in order to perform arbitrary SQL statements against the underlying database.CVE-2017-7973 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability exists within processing of track_import_export.php. The underlying SQLite database query is subject to SQL injection on the object_id input parameter.CVE-2018-7765 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability exists within processing of track_getdata.php. The underlying SQLite database query is subject to SQL injection on the id input parameter.CVE-2018-7766 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of editobject.php. The underlying SQLite database query is subject to SQL injection on the type input parameter.CVE-2018-7767 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of loadtemplate.php. The underlying SQLite database query is subject to SQL injection on the tpl input parameter.CVE-2018-7768 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of xmlserver.php. The underlying SQLite database query is subject to SQL injection on the id input parameter.CVE-2018-7769 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of applets that are exposed on the web service. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the request.CVE-2018-7772 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of nfcserver.php. The underlying SQLite database query is subject to SQL injection on the sessionid input parameter.CVE-2018-7773 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of localize.php. The underlying SQLite database query is subject to SQL injection on the username input parameter.CVE-2018-7774 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Unauthenticated users can execute arbitrary code and exfiltrate files.CVE-2017-7974 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability exists within css.inc.php. The 'css' parameter contains a directory traversal vulnerability.CVE-2018-7763 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The vulnerability exists within runscript.php applet. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.CVE-2018-7764 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The vulnerability exists within processing of sendmail.php. The applet allows callers to select arbitrary files to send to an arbitrary email address.CVE-2018-7770 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The vulnerability exists within processing of editscript.php. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.CVE-2018-7771 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L). The system includes a hard-coded valid session. If an attacker uses that session ID as part of the HTTP cookie of a web request, then authentication is bypassed.CVE-2017-9956 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The system comes with a system web access account hard-coded.CVE-2017-9957 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Improper handling of the system configuration can allow an attacker to execute arbitrary code under the context of root.CVE-2017-9958 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). The system accepts reboot in session from unauthenticated user causing a denial of service.CVE-2017-9959 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The system returns more information than should be passed to an unauthenticated caller who might be an attacker.CVE-2017-9960 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The vulnerability exists within externalframe.php. Exception information is returned to the attacker that contains sensitive path information.CVE-2018-7776 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The vulnerability is due to insufficient handling of update_file request parameter on update_module.php. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.CVE-2018-7777 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Samba since Version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.CVE-2017-7494 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 10