Most recent entries from all

cnvd-2017-22845

EUVD-2026-180071

fkie_cve-2017-7969

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.

GHSA-gm35-5x3x-4xw9

gsd-2017-7969

ICSA-17-201-01 — Schneider Electric PowerSCADA Anywhere and Citect Anywhere

The secure gateway component of the affected products is vulnerable to CSRF for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.CVE-2017-7969 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). An attacker on an adjacent network may be able to specify arbitrary server target nodes in connection requests to the secure gateway and server components.CVE-2017-7970 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The affected products use outdated cipher suites and improperly verify peer SSL certificates.CVE-2017-7971 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). An attacker on an adjacent network may be able to escape out of remote applications and launch other processes.CVE-2017-7972 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).