Open Redirect in Schneider Electric Ecostruxure Power Monitoring Expert (Pme)
CVE-2023-5986
A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.
Vulnerability class: Open Redirect
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.005 (36.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Schneider Electric Ecostruxure Power Monitoring Expert (Pme) — versions Version 2020 CU2 and prior, Version 2021 CU1 and prior
- Schneider Electric Ecostruxure Power Operation (Epo) – Advanced Reporting And Dashboards Module — versions Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021, Advanced Reporting and Dashboards Module 2020 prior to CU3
- Schneider Electric Ecostruxure Power Scada Operation (Pso) - Advanced Reporting And Dashboards Module — versions EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2
- Schneider-Electric Ecostruxure Power Monitoring Expert — versions 2020, 2021
Weakness classification (CWE)
References
- download.schneider-electric.com/files (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-5986?
- CVE-2023-5986 is a high-severity vulnerability in Schneider Electric Ecostruxure Power Monitoring Expert (Pme), classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 8.2/10. Published 2023-11-15.
- How severe is CVE-2023-5986?
- High severity. CVSS v3 base score is 8.2 out of 10.