XXE in Schneider-Electric Wonderware Historian Client
CVE-2017-7907
An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.004 (31.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H.
Affected products
- Schneider-electric Wonderware_historian_client
- N/a Schneider Electric Wonderware Historian Client — versions Schneider Electric Wonderware Historian Client
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- ics-cert@hq.dhs.gov (vdb-entry, x_refsource_SECTRACK)
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
- ics-cert@hq.dhs.gov (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-7907?
- CVE-2017-7907 is a medium-severity vulnerability in Schneider-Electric Wonderware Historian Client, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.6/10. Published 2017-05-19.
- How severe is CVE-2017-7907?
- Medium severity. CVSS v3 base score is 6.6 out of 10.