Details of VAR-202012-1387

ID

VAR-202012-1387

CVE

CVE-2020-7535

TITLE

plural Schneider Electric Path traversal vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2020-014327

DESCRIPTION

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause disclosure of information when sending a specially crafted request to the controller over HTTP. plural Schneider Electric The product contains a path traversal vulnerability.Information may be obtained

Trust: 1.62

sources: NVD: CVE-2020-7535 // JVNDB: JVNDB-2020-014327

AFFECTED PRODUCTS

vendor:	schneider electric	model:	140noc77101	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	bmxnoe0110	scope:	lt	version:	6.6	Trust: 1.0
vendor:	schneider electric	model:	140cpu65150	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	tsxety4103	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	tsxety5103	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	140noe77101	scope:	lt	version:	7.3	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420102	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420302	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	tsxp575634	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342020	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp341000	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	bmxnoe0100	scope:	lt	version:	3.4	Trust: 1.0
vendor:	schneider electric	model:	tsxp576634	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420102cl	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	140noc78100	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	140noc78000	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420302cl	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	140cpu65160	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	140noe77111	scope:	lt	version:	7.3	Trust: 1.0
vendor:	schneider electric	model:	tsxp574634	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342000	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	140noe 77101	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxnoe0110	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420102	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420302cl	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420102cl	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp342020	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp342000	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp341000	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420302	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxnoe0100	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-014327 // NVD: CVE-2020-7535

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-7535
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-7535
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202012-934
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-7535
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2020-7535
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-7535
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-014327 // CNNVD: CNNVD-202012-934 // NVD: CVE-2020-7535

PROBLEMTYPE DATA

problemtype:	CWE-22	Trust: 1.0
problemtype:	Path traversal (CWE-22) [ Other ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-014327 // NVD: CVE-2020-7535

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-934

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202012-934

PATCH

title:	SEVD-2020-343-05	url:	https://www.se.com/ww/en/download/document/SEVD-2020-343-05/	Trust: 0.8
title:	Schneider Electric Modicon M340 Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=136598	Trust: 0.6

sources: JVNDB: JVNDB-2020-014327 // CNNVD: CNNVD-202012-934

EXTERNAL IDS

db:	NVD	id:	CVE-2020-7535	Trust: 2.4
db:	SCHNEIDER	id:	SEVD-2020-343-05	Trust: 1.6
db:	JVNDB	id:	JVNDB-2020-014327	Trust: 0.8
db:	CNNVD	id:	CNNVD-202012-934	Trust: 0.6

sources: JVNDB: JVNDB-2020-014327 // CNNVD: CNNVD-202012-934 // NVD: CVE-2020-7535

REFERENCES

url:	https://www.se.com/ww/en/download/document/sevd-2020-343-05/	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-7535	Trust: 0.8

sources: JVNDB: JVNDB-2020-014327 // CNNVD: CNNVD-202012-934 // NVD: CVE-2020-7535

SOURCES

db:	JVNDB	id:	JVNDB-2020-014327
db:	CNNVD	id:	CNNVD-202012-934
db:	NVD	id:	CVE-2020-7535

LAST UPDATE DATE

2024-11-23T22:58:05.427000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-014327	date:	2021-08-13T08:51:00
db:	CNNVD	id:	CNNVD-202012-934	date:	2020-12-16T00:00:00
db:	NVD	id:	CVE-2020-7535	date:	2024-11-21T05:37:19.907

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-014327	date:	2021-08-13T00:00:00
db:	CNNVD	id:	CNNVD-202012-934	date:	2020-12-11T00:00:00
db:	NVD	id:	CVE-2020-7535	date:	2020-12-11T01:15:12.127