XXE in Schneider-Electric Wonderware Historian Client
CVE-2017-7907
An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (30.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 30.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Schneider-Electric Wonderware Historian Client
- Schneider Electric Wonderware Historian Client — versions Schneider Electric Wonderware Historian Client
Weakness classification (CWE)
References
- www.securityfocus.com/bid/98254 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1038542 (vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-17-122-01 (US Government Resource, Third Party Advisory, Mitigation)
- software.schneider-electric.com/pdf/security-bulletin/lfsec00000120/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2017-7907?
- CVE-2017-7907 is a medium-severity vulnerability in Schneider-Electric Wonderware Historian Client, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.6/10. Published 2017-05-19.
- How severe is CVE-2017-7907?
- Medium severity. CVSS v3 base score is 6.6 out of 10.