Open Redirect in Schneider-Electric Ecostruxure Energy Expert
CVE-2018-7797
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert 1.3 (formerly Power Manager), EcoStruxure Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxure Power Monitoring Expert (PME) v9.0, EcoStruxure Energy Expert v2.0, and EcoStruxure Power SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module which could cause a phishing attack when redirected to a malicious site.
Vulnerability class: Open Redirect
EPSS: 0.008 (51.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Schneider-electric Ecostruxure_energy_expert — versions 1.3, 2.0
- Schneider-electric Ecostruxure_power_monitoring_expert — versions 8.2, 9.0
- Schneider-electric Ecostruxure_power_scada_operation — versions 8.2, 9.0
- Schneider Electric Se Power Monitoring Expert, Energy Expert (Formerly Manager) - Ecostruxureª (Pme) V8.2 (All Editions), 1.3 Manager), Scada Operation (Pso) 8.2 Advanced Reports And Dashboards Module, V9.0, V2.0, Ecostruxureªpower 9.0 Module — versions EcoStruxureª, Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxureª, Energy Expert 1.3 (formerly Power Manager), EcoStruxureª
Weakness classification (CWE)
References
- cybersecurity@se.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cybersecurity@se.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-7797?
- CVE-2018-7797 is a medium-severity vulnerability in Schneider-Electric Ecostruxure Energy Expert, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2018-12-17.
- How severe is CVE-2018-7797?
- Medium severity. CVSS v3 base score is 6.1 out of 10.