Open Redirect in Schneider Electric Ecostruxure Power Monitoring Expert (Pme)
CVE-2023-5986
A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.
Vulnerability class: Open Redirect
EPSS: 0.005 (37.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N.
Affected products
- Schneider Electric Ecostruxure Power Monitoring Expert (Pme) — versions Version 2020 CU2 and prior, Version 2021 CU1 and prior
- Schneider Electric Ecostruxure Power Operation (Epo) – Advanced Reporting And Dashboards Module — versions Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021, Advanced Reporting and Dashboards Module 2020 prior to CU3
- Schneider Electric Ecostruxure Power Scada Operation (Pso) - Advanced Reporting And Dashboards Module — versions EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2
- Schneider-electric Ecostruxure_power_monitoring_expert — versions 2020, 2021
Weakness classification (CWE)
References
- cybersecurity@se.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-5986?
- CVE-2023-5986 is a high-severity vulnerability in Schneider Electric Ecostruxure Power Monitoring Expert (Pme), classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 8.2/10. Published 2023-11-15.
- How severe is CVE-2023-5986?
- High severity. CVSS v3 base score is 8.2 out of 10.