Sign-up

ID

VAR-201903-0624


CVE

CVE-2015-6462


TITLE

Schneider Electric Modicon PLC Cross-Site Scripting Vulnerability

Trust: 0.8

sources: IVD: 7c549830-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05939

DESCRIPTION

Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser. plural Schneider Electric Modicon The product contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Modicon PLC is a programmable controller product for the dam, energy, food agriculture and other industries. Multiple Schneider Electric Modicon M340 PLC products are prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. Schneider Electric Modicon PLC BMXNOC0401 etc. are programmable controllers of French Schneider Electric (Schneider Electric). The following products are affected: Schneider Electric Modicon PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, BMXP3420303030

Trust: 2.7

sources: NVD: CVE-2015-6462 // JVNDB: JVNDB-2015-008241 // CNVD: CNVD-2015-05939 // BID: 76613 // IVD: 7c549830-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-84423

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 7c549830-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05939

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon m340 bmxp3420302hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342030hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0100scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0110scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoc0401scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0110hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnor0200hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp3420302scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342030scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342020hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342020scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoc0401scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0100scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0110scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0110hscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnor0200hscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342020scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342020hscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342030scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp3420302scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp3420302hscope: - version: -

Trust: 0.8

vendor:schneidermodel:electric modicon plcscope: - version: -

Trust: 0.6

vendor:schneider electricmodel:modicon m340 bmxp342030hscope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxp3420302hscope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxp3420302scope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxp342030scope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxp342020hscope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxp342020scope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxnor0200hscope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxnoe0110hscope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxnoe0110scope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxnoe0100scope: - version: -

Trust: 0.3

vendor:schneider electricmodel:modicon m340 bmxnoc0401scope: - version: -

Trust: 0.3

vendor:bmxnoc0401model: - scope:eqversion: -

Trust: 0.2

vendor:bmxp3420302hmodel: - scope:eqversion: -

Trust: 0.2

vendor:bmxp342030hmodel: - scope:eqversion: -

Trust: 0.2

vendor:bmxnoe0100model: - scope:eqversion: -

Trust: 0.2

vendor:bmxnoe0110model: - scope:eqversion: -

Trust: 0.2

vendor:bmxnoe0110hmodel: - scope:eqversion: -

Trust: 0.2

vendor:bmxnor0200hmodel: - scope:eqversion: -

Trust: 0.2

vendor:bmxp342020model: - scope:eqversion: -

Trust: 0.2

vendor:bmxp342020hmodel: - scope:eqversion: -

Trust: 0.2

vendor:bmxp342030model: - scope:eqversion: -

Trust: 0.2

vendor:bmxp3420302model: - scope:eqversion: -

Trust: 0.2

sources: IVD: 7c549830-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05939 // BID: 76613 // JVNDB: JVNDB-2015-008241 // NVD: CVE-2015-6462

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6462
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-6462
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-05939
value: LOW

Trust: 0.6

CNNVD: CNNVD-201509-443
value: MEDIUM

Trust: 0.6

IVD: 7c549830-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-84423
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2015-6462
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-05939
severity: LOW
baseScore: 3.2
vectorString: AV:L/AC:L/AU:S/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.1
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7c549830-2351-11e6-abef-000c29c66e3d
severity: LOW
baseScore: 3.2
vectorString: AV:L/AC:L/AU:S/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.1
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-84423
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-6462
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: IVD: 7c549830-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05939 // VULHUB: VHN-84423 // JVNDB: JVNDB-2015-008241 // CNNVD: CNNVD-201509-443 // NVD: CVE-2015-6462

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-84423 // JVNDB: JVNDB-2015-008241 // NVD: CVE-2015-6462

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201509-443

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201509-443

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-008241

PATCH
title:トップページurl:https://www.se.com/jp/ja/
Trust: 0.8
title:Patch for Schneider Electric Modicon PLC Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/63775
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-05939 // 
            
            
            
            JVNDB: JVNDB-2015-008241

EXTERNAL IDS
db:NVDid:CVE-2015-6462
Trust: 3.6
db:ICS CERTid:ICSA-15-246-02
Trust: 3.4
db:CNNVDid:CNNVD-201509-443
Trust: 0.9
db:CNVDid:CNVD-2015-05939
Trust: 0.8
db:JVNDBid:JVNDB-2015-008241
Trust: 0.8
db:SCHNEIDERid:SEVD-2015-233-01
Trust: 0.6
db:BIDid:76613
Trust: 0.4
db:IVDid:7C549830-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-84423
Trust: 0.1
sources:
            
            
            IVD: 7c549830-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2015-05939 // 
            
            
            
            VULHUB: VHN-84423 // 
            
            
            
            BID: 76613 // 
            
            
            
            JVNDB: JVNDB-2015-008241 // 
            
            
            
            CNNVD: CNNVD-201509-443 // 
            
            
            
            NVD: CVE-2015-6462

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-15-246-02
Trust: 3.4
url:https://nvd.nist.gov/vuln/detail/cve-2015-6462
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6462
Trust: 0.8
url:http://download.schneider-electric.com/files?p_file_id=1039693246&p_file_name=sevd-2015-233-01.pdf
Trust: 0.6
url:http://www.schneider-electric.com/en/product-range/1468-modicon-m340/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2015-05939 // 
            
            
            
            VULHUB: VHN-84423 // 
            
            
            
            BID: 76613 // 
            
            
            
            JVNDB: JVNDB-2015-008241 // 
            
            
            
            CNNVD: CNNVD-201509-443 // 
            
            
            
            NVD: CVE-2015-6462

CREDITS
Aditya K. Sood and Juan Francisco Bolivar
Trust: 0.9
sources:
            
            
            BID: 76613 // 
            
            
            
            CNNVD: CNNVD-201509-443

SOURCES
db:IVDid:7c549830-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2015-05939
db:VULHUBid:VHN-84423
db:BIDid:76613
db:JVNDBid:JVNDB-2015-008241
db:CNNVDid:CNNVD-201509-443
db:NVDid:CVE-2015-6462

LAST UPDATE DATE
2024-11-23T22:30:07.838000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-05939date:2015-09-11T00:00:00
db:VULHUBid:VHN-84423date:2019-10-09T00:00:00
db:BIDid:76613date:2015-09-03T00:00:00
db:JVNDBid:JVNDB-2015-008241date:2019-05-07T00:00:00
db:CNNVDid:CNNVD-201509-443date:2019-10-10T00:00:00
db:NVDid:CVE-2015-6462date:2024-11-21T02:35:00.833

SOURCES RELEASE DATE
db:IVDid:7c549830-2351-11e6-abef-000c29c66e3ddate:2015-09-11T00:00:00
db:CNVDid:CNVD-2015-05939date:2015-09-11T00:00:00
db:VULHUBid:VHN-84423date:2019-03-21T00:00:00
db:BIDid:76613date:2015-09-03T00:00:00
db:JVNDBid:JVNDB-2015-008241date:2019-05-07T00:00:00
db:CNNVDid:CNNVD-201509-443date:2015-09-23T00:00:00
db:NVDid:CVE-2015-6462date:2019-03-21T19:29:00.317