CVE-2013-2796

Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS v2.0 6.9 MEDIUM

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02	US Government Resource
http://www.citect.schneider-electric.com/cs-HF720SP459363	Patch
http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02	US Government Resource
http://www.citect.schneider-electric.com/cs-HF720SP459363	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:schneider-electric:citectscada::::::::
	cpe:2.3:a:schneider-electric:citectscada:7.10:::::::*
	cpe:2.3:a:schneider-electric:powerlogic_scada::::::::
	cpe:2.3:a:schneider-electric:powerlogic_scada:7.10:::::::*
	cpe:2.3:a:schneider-electric:vijeo_citect::::::::
	cpe:2.3:a:schneider-electric:vijeo_citect:7.10:::::::*

History

21 Nov 2024, 01:52

Type	Values Removed	Values Added
References	~~() http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02 - US Government Resource~~	() http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02 - US Government Resource
References	~~() http://www.citect.schneider-electric.com/cs-HF720SP459363 - Patch~~	() http://www.citect.schneider-electric.com/cs-HF720SP459363 - Patch

Information

Published : 2013-08-09 23:55

Updated : 2024-11-21 01:52

NVD link : CVE-2013-2796

Mitre link : CVE-2013-2796

CVE.ORG link : CVE-2013-2796

JSON object : View

Products Affected

schneider-electric

vijeo_citect
citectscada
powerlogic_scada

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-2796", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-08-09T23:55:02.537", "references": [{"url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.citect.schneider-electric.com/cs-HF720SP459363", "tags": ["Patch"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.citect.schneider-electric.com/cs-HF720SP459363", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Schneider Electric Vijeo Citect 7.20 and earlier, CitectSCADA 7.20 and earlier, and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}, {"lang": "es", "value": "Schneider Electric Vijeo Citect v7.20 y anteriores, CitectSCADA v7.20 y anteriores, y PowerLogic SCADA v7.20 y anteriores, permite a atacantes remotos leer ficheros, enviar peticiones HTTP a servidores intranet, o causar una denegaci\u00f3n del servicio (consumo de CPU y memoria) a trav\u00e9s de fichero XML que contiene una declaraci\u00f3n de entidad externa, junto con una referencia de entidad, en relaci\u00f3n con un fallo en XML External Entity (XXE)."}], "lastModified": "2024-11-21T01:52:23.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:citectscada:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F38EF72-DCCB-47DE-AF76-73A78D9F069A", "versionEndIncluding": "7.20"}, {"criteria": "cpe:2.3:a:schneider-electric:citectscada:7.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E87F308E-8874-40CD-BB46-9CD955AEE26E"}, {"criteria": "cpe:2.3:a:schneider-electric:powerlogic_scada:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "692487FE-D5CC-4289-8C4B-26C30C12BB08", "versionEndIncluding": "7.20"}, {"criteria": "cpe:2.3:a:schneider-electric:powerlogic_scada:7.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "227FA3FF-F09B-4891-9B90-37563E1A579C"}, {"criteria": "cpe:2.3:a:schneider-electric:vijeo_citect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "261173CE-D744-4427-ABCB-AD9BA9CCCF25", "versionEndIncluding": "7.20"}, {"criteria": "cpe:2.3:a:schneider-electric:vijeo_citect:7.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "281F678E-1B21-4EFD-A9F6-016FCECF1DA0"}], "operator": "OR"}]}], "evaluatorComment": "Per: http://ics-cert.us-cert.gov/advisories/ICSA-13-217-02\n\n\"This vulnerability is not exploitable remotely.\"", "sourceIdentifier": "ics-cert@hq.dhs.gov"}