Most recent entries from all

cnvd-2017-05156

EUVD-2026-73122

fkie_cve-2017-5156

A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.

GHSA-cx74-jcx5-x32v

gsd-2017-5156

ICSA-17-089-01 — Schneider Electric Wonderware InTouch Access Anywhere

The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.CVE-2017-5156 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.CVE-2017-5158 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated by Schneider Electric; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The software will connect via Transport Layer Security without verifying the peer 's SSL certificate properly.CVE-2017-5160 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).