Details of VAR-201709-1051

ID

VAR-201709-1051

CVE

CVE-2017-13754

TITLE

Wibu-Systems CodeMeter Cross-Site Scripting Vulnerability

Trust: 1.4

sources: IVD: 05bed560-8aa3-476d-a0cb-40b1fdd83a18 // CNVD: CNVD-2017-32459 // CNNVD: CNNVD-201709-058

DESCRIPTION

Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html. Wibu-Systems CodeMeter Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Wibu-Systems CodeMeter is a suite of anti-piracy protection products from Wibu-Systems, Germany for software protection against piracy and unsecure software. The product uses encryption technology and a small USB hardware device, CmStick, which has a 128KB secure amount of SmartCard chip for storing license and license related data. Wibu-Systems CodeMeter is prone to a cross-site scripting vulnerability because it fails to properly handle user-supplied input. An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. Versions prior to CodeMeter 6.50b are vulnerable

Trust: 2.61

sources: NVD: CVE-2017-13754 // JVNDB: JVNDB-2017-007768 // CNVD: CNVD-2017-32459 // BID: 104433 // IVD: 05bed560-8aa3-476d-a0cb-40b1fdd83a18

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 05bed560-8aa3-476d-a0cb-40b1fdd83a18 // CNVD: CNVD-2017-32459

AFFECTED PRODUCTS

vendor:	wibu	model:	codemeter	scope:	lte	version:	6.50a	Trust: 1.0
vendor:	wibu	model:	codemeter	scope:	lt	version:	6.50b	Trust: 0.8
vendor:	wibu	model:	codemeter <6.50b	scope:	-	version:	-	Trust: 0.6
vendor:	wibu	model:	codemeter	scope:	eq	version:	6.50a	Trust: 0.6
vendor:	wibu	model:	codemeter 6.50a	scope:	-	version:	-	Trust: 0.3
vendor:	wibu	model:	codemeter 4.50b	scope:	-	version:	-	Trust: 0.3
vendor:	wibu	model:	codemeter	scope:	eq	version:	4.40	Trust: 0.3
vendor:	wibu	model:	codemeter 4.30d	scope:	-	version:	-	Trust: 0.3
vendor:	wibu	model:	codemeter 4.30c	scope:	-	version:	-	Trust: 0.3
vendor:	wibu	model:	codemeter 4.20b	scope:	-	version:	-	Trust: 0.3
vendor:	rockwell	model:	automation studio view designer	scope:	eq	version:	50000	Trust: 0.3
vendor:	rockwell	model:	automation studio logix emulate	scope:	eq	version:	50000	Trust: 0.3
vendor:	rockwell	model:	automation studio logix designer	scope:	eq	version:	50000	Trust: 0.3
vendor:	rockwell	model:	automation studio architect	scope:	eq	version:	50000	Trust: 0.3
vendor:	rockwell	model:	automation softlogix	scope:	eq	version:	58000	Trust: 0.3
vendor:	rockwell	model:	automation rsview32	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation rslogix5	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation rslogix emulate	scope:	eq	version:	50000	Trust: 0.3
vendor:	rockwell	model:	automation rslogix	scope:	eq	version:	5000	Trust: 0.3
vendor:	rockwell	model:	automation rslinx classic	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation rsfieldbus	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk viewpoint	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk view site edition	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk view machine edition	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk vantagepoint	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk transaction manager	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk metrics	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk information server	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk historian site edition	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk historian classic	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk gateway	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk eprocedure	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk energymetrix	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk batch	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk assetcentre	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk activation manager	scope:	eq	version:	4.01	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk activation manager	scope:	eq	version:	4.00	Trust: 0.3
vendor:	rockwell	model:	automation factorytalk activation manager	scope:	eq	version:	3.40	Trust: 0.3
vendor:	rockwell	model:	automation emonitor	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	automation arena	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwell	model:	rsnetworx	scope:	eq	version:	0	Trust: 0.3
vendor:	rockwall	model:	automation rslogix	scope:	eq	version:	50000	Trust: 0.3
vendor:	wibu	model:	codemeter 6.50b	scope:	ne	version:	-	Trust: 0.3
vendor:	codemeter	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 05bed560-8aa3-476d-a0cb-40b1fdd83a18 // CNVD: CNVD-2017-32459 // BID: 104433 // JVNDB: JVNDB-2017-007768 // CNNVD: CNNVD-201709-058 // NVD: CVE-2017-13754

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-13754
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-13754
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2017-32459
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201709-058
value:	LOW
Trust: 0.6
IVD:	05bed560-8aa3-476d-a0cb-40b1fdd83a18
value:	LOW
Trust: 0.2

nvd@nist.gov:	CVE-2017-13754
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-32459
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	05bed560-8aa3-476d-a0cb-40b1fdd83a18
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2017-13754
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: IVD: 05bed560-8aa3-476d-a0cb-40b1fdd83a18 // CNVD: CNVD-2017-32459 // JVNDB: JVNDB-2017-007768 // CNNVD: CNNVD-201709-058 // NVD: CVE-2017-13754

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2017-007768 // NVD: CVE-2017-13754

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-058

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201709-058

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-007768

PATCH

title:	CodeMeter	url:	http://www.wibu.com/codemeter.html	Trust: 0.8
title:	Patch for Wibu-Systems CodeMeter Cross-Site Scripting Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/105240	Trust: 0.6
title:	Wibu-Systems CodeMeter Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74525	Trust: 0.6

sources: CNVD: CNVD-2017-32459 // JVNDB: JVNDB-2017-007768 // CNNVD: CNNVD-201709-058

EXTERNAL IDS

db:	NVD	id:	CVE-2017-13754	Trust: 3.5
db:	ICS CERT	id:	ICSA-18-102-02	Trust: 2.1
db:	BID	id:	104433	Trust: 1.3
db:	EXPLOIT-DB	id:	42610	Trust: 1.0
db:	CNVD	id:	CNVD-2017-32459	Trust: 0.8
db:	CNNVD	id:	CNNVD-201709-058	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-007768	Trust: 0.8
db:	EXPLOITDB	id:	42610	Trust: 0.6
db:	IVD	id:	05BED560-8AA3-476D-A0CB-40B1FDD83A18	Trust: 0.2

sources: IVD: 05bed560-8aa3-476d-a0cb-40b1fdd83a18 // CNVD: CNVD-2017-32459 // BID: 104433 // JVNDB: JVNDB-2017-007768 // CNNVD: CNNVD-201709-058 // NVD: CVE-2017-13754

REFERENCES

url:	https://www.vulnerability-lab.com/get_content.php?id=2074	Trust: 2.4
url:	http://seclists.org/fulldisclosure/2017/sep/1	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2017-13754	Trust: 1.4
url:	https://ics-cert.us-cert.gov/advisories/icsa-18-102-02	Trust: 1.3
url:	http://www.securityfocus.com/archive/1/541119/100/0/threaded	Trust: 1.0
url:	http://www.securityfocus.com/bid/104433	Trust: 1.0
url:	https://www.exploit-db.com/exploits/42610/	Trust: 1.0
url:	https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073133	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13754	Trust: 0.8
url:	https://www.us-cert.gov/ics/advisories/icsa-18-102-02	Trust: 0.8
url:	http://www.securityfocus.com/archive/1/archive/1/541119/100/0/threaded	Trust: 0.6
url:	http://www.rockwellautomation.com/	Trust: 0.3
url:	http://www.wibu.com/	Trust: 0.3

sources: CNVD: CNVD-2017-32459 // BID: 104433 // JVNDB: JVNDB-2017-007768 // CNNVD: CNNVD-201709-058 // NVD: CVE-2017-13754

CREDITS

Rockwell Automation

Trust: 0.3

sources: BID: 104433

SOURCES

db:	IVD	id:	05bed560-8aa3-476d-a0cb-40b1fdd83a18
db:	CNVD	id:	CNVD-2017-32459
db:	BID	id:	104433
db:	JVNDB	id:	JVNDB-2017-007768
db:	CNNVD	id:	CNNVD-201709-058
db:	NVD	id:	CVE-2017-13754

LAST UPDATE DATE

2024-11-23T22:22:47.059000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-32459	date:	2017-11-02T00:00:00
db:	BID	id:	104433	date:	2018-05-10T00:00:00
db:	JVNDB	id:	JVNDB-2017-007768	date:	2019-07-10T00:00:00
db:	CNNVD	id:	CNNVD-201709-058	date:	2017-09-11T00:00:00
db:	NVD	id:	CVE-2017-13754	date:	2024-11-21T03:11:35.880

SOURCES RELEASE DATE

db:	IVD	id:	05bed560-8aa3-476d-a0cb-40b1fdd83a18	date:	2017-11-02T00:00:00
db:	CNVD	id:	CNVD-2017-32459	date:	2017-11-02T00:00:00
db:	BID	id:	104433	date:	2018-05-10T00:00:00
db:	JVNDB	id:	JVNDB-2017-007768	date:	2017-10-02T00:00:00
db:	CNNVD	id:	CNNVD-201709-058	date:	2017-08-29T00:00:00
db:	NVD	id:	CVE-2017-13754	date:	2017-09-07T13:29:00.620