CVE-2020-7492

A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is entering the password because it is not masqueraded.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.se.com/ww/en/download/document/SEVD-2020-133-01/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:schneider-electric:gp-pro_ex_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-16 20:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-7492

Mitre link : CVE-2020-7492

CVE.ORG link : CVE-2020-7492

JSON object : View

Products Affected

schneider-electric

gp-pro_ex_firmware

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2020-7492", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-06-16T20:15:14.177", "references": [{"url": "https://www.se.com/ww/en/download/document/SEVD-2020-133-01/", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-521"}]}, {"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is entering the password because it is not masqueraded."}, {"lang": "es", "value": "CWE-521: Se presenta una vulnerabilidad de Requisitos de Contrase\u00f1a D\u00e9biles en GP-Pro EX versiones V1.00 hasta V4.09.100, lo que podr\u00eda causar el descubrimiento de la contrase\u00f1a cuando el usuario ingresa la contrase\u00f1a porque no est\u00e1 enmascarada"}], "lastModified": "2020-06-24T13:49:53.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:gp-pro_ex_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "300993CC-80A5-4534-A08C-ADC7E6C49B9F", "versionEndIncluding": "4.09.120", "versionStartIncluding": "1.00"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}