CVE-2020-7572

{"id": "CVE-2020-7572", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-11-19T22:15:15.457", "references": [{"url": "https://www.se.com/ww/en/download/document/SEVD-2020-315-04/", "tags": ["Patch", "Product", "Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de Restricci\u00f3n Inapropiada de una Referencia de tipo XML External Entity CWE-611 en EcoStruxure Building Operation WebReports versiones V1.9 - V3.1, que podr\u00eda causar que un usuario remoto autenticado pueda inyectar c\u00f3digo XML arbitrario y obtener una divulgaci\u00f3n de datos confidenciales, una denegaci\u00f3n de servicio, una falsificaci\u00f3n de peticiones del lado del servidor debido a una configuraci\u00f3n inapropiada del analizador XML"}], "lastModified": "2022-01-31T19:45:05.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:webreports:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFEA3AED-DBEB-4B15-AD56-CEE221637C39", "versionEndIncluding": "3.1", "versionStartIncluding": "1.9"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}