Sign-up

ID

VAR-201606-0249


CVE

CVE-2016-4513


TITLE

Schneider Electric PowerLogic PM8ECC Cross-Site Scripting Vulnerability

Trust: 0.8

sources: IVD: 57184422-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-04264

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the Schneider Electric PowerLogic PM8ECC module before 2.651 for PowerMeter 800 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Schneider Electric PowerLogic PM8ECC is a communication module for Schneider Electric in France for the 800 series of meters. A remote attacker can use this vulnerability to inject arbitrary JavaScript code by sending a specially crafted URL request. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to Schneider ElectricPowerLogic PM8ECC 2.651 are affected

Trust: 2.7

sources: NVD: CVE-2016-4513 // JVNDB: JVNDB-2016-003351 // CNVD: CNVD-2016-04264 // BID: 91345 // IVD: 57184422-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-93332

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 57184422-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-04264

AFFECTED PRODUCTS

vendor:schneider electricmodel:powerlogic pm8eccscope:lteversion:2.60

Trust: 1.0

vendor:schneider electricmodel:powerlogic pm8eccscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:powerlogic pm8eccscope:ltversion:2.651

Trust: 0.8

vendor:schneidermodel:electric powerlogic pm8eccscope:ltversion:2.651

Trust: 0.6

vendor:schneider electricmodel:powerlogic pm8eccscope:eqversion:2.60

Trust: 0.6

vendor:powerlogic pm8eccmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 57184422-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-04264 // JVNDB: JVNDB-2016-003351 // CNNVD: CNNVD-201606-487 // NVD: CVE-2016-4513

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4513
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-4513
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2016-04264
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201606-487
value: MEDIUM

Trust: 0.6

IVD: 57184422-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-93332
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-4513
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-04264
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 57184422-2351-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-93332
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4513
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: IVD: 57184422-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2016-04264 // VULHUB: VHN-93332 // JVNDB: JVNDB-2016-003351 // CNNVD: CNNVD-201606-487 // NVD: CVE-2016-4513

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-93332 // JVNDB: JVNDB-2016-003351 // NVD: CVE-2016-4513

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201606-487

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201606-487

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-003351

PATCH
title:PM8ECC V2.651 Firmwareurl:http://www.schneider-electric.com/ww/en/download/document/p8e02651_DOT_bin
Trust: 0.8
title:Patch for Schneider Electric PowerLogic PM8ECC Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/78044
Trust: 0.6
title:Schneider Electric PowerLogic PM8ECC Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62413
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-04264 // 
            
            
            
            JVNDB: JVNDB-2016-003351 // 
            
            
            
            CNNVD: CNNVD-201606-487

EXTERNAL IDS
db:NVDid:CVE-2016-4513
Trust: 3.6
db:ICS CERTid:ICSA-16-173-02
Trust: 3.1
db:CNNVDid:CNNVD-201606-487
Trust: 0.9
db:CNVDid:CNVD-2016-04264
Trust: 0.8
db:JVNDBid:JVNDB-2016-003351
Trust: 0.8
db:BIDid:91345
Trust: 0.4
db:IVDid:57184422-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-93332
Trust: 0.1
sources:
            
            
            IVD: 57184422-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2016-04264 // 
            
            
            
            VULHUB: VHN-93332 // 
            
            
            
            BID: 91345 // 
            
            
            
            JVNDB: JVNDB-2016-003351 // 
            
            
            
            CNNVD: CNNVD-201606-487 // 
            
            
            
            NVD: CVE-2016-4513

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-16-173-02
Trust: 3.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4513
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4513
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2016-04264 // 
            
            
            
            VULHUB: VHN-93332 // 
            
            
            
            JVNDB: JVNDB-2016-003351 // 
            
            
            
            CNNVD: CNNVD-201606-487 // 
            
            
            
            NVD: CVE-2016-4513

CREDITS
The vendor reported the issue.
Trust: 0.3
sources:
            
            
            BID: 91345

SOURCES
db:IVDid:57184422-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2016-04264
db:VULHUBid:VHN-93332
db:BIDid:91345
db:JVNDBid:JVNDB-2016-003351
db:CNNVDid:CNNVD-201606-487
db:NVDid:CVE-2016-4513

LAST UPDATE DATE
2024-11-23T22:56:21.766000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-04264date:2016-06-23T00:00:00
db:VULHUBid:VHN-93332date:2016-06-28T00:00:00
db:BIDid:91345date:2016-06-21T00:00:00
db:JVNDBid:JVNDB-2016-003351date:2016-06-29T00:00:00
db:CNNVDid:CNNVD-201606-487date:2016-06-27T00:00:00
db:NVDid:CVE-2016-4513date:2024-11-21T02:52:22.803

SOURCES RELEASE DATE
db:IVDid:57184422-2351-11e6-abef-000c29c66e3ddate:2016-06-23T00:00:00
db:CNVDid:CNVD-2016-04264date:2016-06-23T00:00:00
db:VULHUBid:VHN-93332date:2016-06-26T00:00:00
db:BIDid:91345date:2016-06-21T00:00:00
db:JVNDBid:JVNDB-2016-003351date:2016-06-29T00:00:00
db:CNNVDid:CNNVD-201606-487date:2016-06-22T00:00:00
db:NVDid:CVE-2016-4513date:2016-06-26T01:59:03.647