Most recent entries from all

cnvd-2017-05157

EUVD-2026-73134

fkie_cve-2017-5158

An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.

GHSA-h4hc-5cmg-rhc2

gsd-2017-5158

ICSA-17-089-01 — Schneider Electric Wonderware InTouch Access Anywhere

The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.CVE-2017-5156 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.CVE-2017-5158 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated by Schneider Electric; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The software will connect via Transport Layer Security without verifying the peer 's SSL certificate properly.CVE-2017-5160 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).