CVE-2021-22781

{"id": "CVE-2021-22781", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-07-14T15:15:08.377", "references": [{"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause a leak of SMTP credential used for mailbox authentication when an attacker can access a project file."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de credenciales insuficientemente protegidas en EcoStruxure Control Expert (todas las versiones anteriores a V15.0 SP1, incluidas todas las versiones de Unity Pro), EcoStruxure Process Expert (todas las versiones, incluidas todas las versiones de EcoStruxure Hybrid DCS) y SCADAPack RemoteConnect for x70, todas las versiones, que podr\u00eda causar una filtraci\u00f3n de credenciales SMTP usadas para la autenticaci\u00f3n del buz\u00f3n cuando un atacante puede acceder a un archivo de proyecto"}], "lastModified": "2021-07-26T13:48:07.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43140BF9-455B-4E3C-BF5E-BB9BBF9802D2", "versionEndExcluding": "15.0"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9BF2D84-901E-4D34-941F-FFAB85B0E9D3"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_process_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD97669F-93D5-42C4-BFC4-1993867F5911"}, {"criteria": "cpe:2.3:a:schneider-electric:remoteconnect:*:*:*:*:*:*:scadapack_x70:*", "vulnerable": true, "matchCriteriaId": "2D7E0B75-171E-4A73-B722-13473CE1B9D7"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}