CVE-2023-37199
Assigner: schneider
Published: 2023-07-12T07:04:08.510Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: StruxureWare Data Center Expert 
vendor: Schneider Electric
versions: status: affected
version: v7.9.3 and earlier
descriptions: supportingMedia: base64: no
type: text/html
value: 

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause remote code execution when an admin user on DCE tampers with backups which
are then manually restored. 



value: 
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
could cause remote code execution when an admin user on DCE tampers with backups which
are then manually restored. 



metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev