6.6med
CVE-2017-7907
An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.6
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 33%
Public exploits
0
none known
Summary
An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference, or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network.
Exploit prediction (EPSS)
0.39% probability of exploitation in the next 30 days, higher than 33% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.6 | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 3.3 | AV:L/AC:M/Au:N/C:P/I:N/A:P |
Affected products
- n/a Schneider Electric Wonderware Historian Client
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- securityfocus.com /bid/98254 · vdb-entry, x_refsource_BID, x_transferred
- securitytracker.com /id/1038542 · vdb-entry, x_refsource_SECTRACK, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-17-122-01 · x_refsource_MISC, x_transferred
- software.schneider-electric.com /pdf/security-bulletin/lfsec00000120/ · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-7907
- NVD: CVE-2017-7907
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.