Sign-up

ID

VAR-202303-1424


CVE

CVE-2023-27984


TITLE

Schneider Electric IGSS Data Server Input Validation Error Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2023-29376 // CNNVD: CNNVD-202303-1568

DESCRIPTION

A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report file planted by an attacker. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior). Schneider Electric of custom reports , IGSS Dashboard (DashBoard.exe) , igss data server There is an input validation vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric IGSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the openReport function. The issue results from the lack of proper input validation. An attacker can leverage this vulnerability to execute code in the context of the current user. Schneider Electric IGSS Data Server is a data server of an interactive graphic Scada system of French Schneider Electric (Schneider Electric)

Trust: 2.79

sources: NVD: CVE-2023-27984 // JVNDB: JVNDB-2023-005630 // ZDI: ZDI-23-341 // CNVD: CNVD-2023-29376

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-29376

AFFECTED PRODUCTS

vendor:schneider electricmodel:igss dashboardscope:lteversion:16.0.0.23040

Trust: 1.0

vendor:schneider electricmodel:igss data serverscope:lteversion:16.0.0.23040

Trust: 1.0

vendor:schneider electricmodel:custom reportsscope:lteversion:16.0.0.23040

Trust: 1.0

vendor:schneider electricmodel:igss dashboardscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:custom reportsscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:igss data serverscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:igssscope: - version: -

Trust: 0.7

vendor:schneidermodel:electric igss data serverscope:lteversion:<=v16.0.0.23040

Trust: 0.6

vendor:schneidermodel:electric igss dashboardscope:lteversion:<=v16.0.0.23040

Trust: 0.6

vendor:schneidermodel:electric custom reportsscope:lteversion:<=v16.0.0.23040

Trust: 0.6

sources: ZDI: ZDI-23-341 // CNVD: CNVD-2023-29376 // JVNDB: JVNDB-2023-005630 // NVD: CVE-2023-27984

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-27984
value: HIGH

Trust: 1.0

cybersecurity@se.com: CVE-2023-27984
value: HIGH

Trust: 1.0

NVD: CVE-2023-27984
value: HIGH

Trust: 0.8

ZDI: CVE-2023-27984
value: HIGH

Trust: 0.7

CNVD: CNVD-2023-29376
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202303-1568
value: HIGH

Trust: 0.6

CNVD: CNVD-2023-29376
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-27984
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

cybersecurity@se.com: CVE-2023-27984
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-27984
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-27984
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-341 // CNVD: CNVD-2023-29376 // JVNDB: JVNDB-2023-005630 // CNNVD: CNNVD-202303-1568 // NVD: CVE-2023-27984 // NVD: CVE-2023-27984

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-005630 // NVD: CVE-2023-27984

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202303-1568

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202303-1568

PATCH

title:Schneider Electric has issued an update to correct this vulnerability.url:https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf

Trust: 0.7

title:Patch for Schneider Electric IGSS Data Server Input Validation Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/419161

Trust: 0.6

title:Schneider Electric IGSS Data Server Enter the fix for the verification error vulnerabilityurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=230407

Trust: 0.6

sources: ZDI: ZDI-23-341 // CNVD: CNVD-2023-29376 // CNNVD: CNNVD-202303-1568

EXTERNAL IDS

db:NVDid:CVE-2023-27984

Trust: 4.5

db:SCHNEIDERid:SEVD-2023-073-04

Trust: 3.0

db:ICS CERTid:ICSA-23-082-04

Trust: 0.8

db:JVNid:JVNVU94559502

Trust: 0.8

db:JVNDBid:JVNDB-2023-005630

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-19420

Trust: 0.7

db:ZDIid:ZDI-23-341

Trust: 0.7

db:CNVDid:CNVD-2023-29376

Trust: 0.6

db:AUSCERTid:ESB-2023.1792

Trust: 0.6

db:CNNVDid:CNNVD-202303-1568

Trust: 0.6

sources: ZDI: ZDI-23-341 // CNVD: CNVD-2023-29376 // JVNDB: JVNDB-2023-005630 // CNNVD: CNNVD-202303-1568 // NVD: CVE-2023-27984

REFERENCES

url:https://download.schneider-electric.com/files?p_doc_ref=sevd-2023-073-04&p_endoctype=security+and+safety+notice&p_file_name=sevd-2023-073-04.pdf

Trust: 3.7

url:https://jvn.jp/vu/jvnvu94559502/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-27984

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-04

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-27984/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2023.1792

Trust: 0.6

sources: ZDI: ZDI-23-341 // CNVD: CNVD-2023-29376 // JVNDB: JVNDB-2023-005630 // CNNVD: CNNVD-202303-1568 // NVD: CVE-2023-27984

CREDITS

kimiya

Trust: 0.7

sources: ZDI: ZDI-23-341

SOURCES

db:ZDIid:ZDI-23-341
db:CNVDid:CNVD-2023-29376
db:JVNDBid:JVNDB-2023-005630
db:CNNVDid:CNNVD-202303-1568
db:NVDid:CVE-2023-27984

LAST UPDATE DATE

2024-08-14T13:20:57.350000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-341date:2023-03-16T00:00:00
db:CNVDid:CNVD-2023-29376date:2023-04-20T00:00:00
db:JVNDBid:JVNDB-2023-005630date:2023-11-09T03:11:00
db:CNNVDid:CNNVD-202303-1568date:2023-03-27T00:00:00
db:NVDid:CVE-2023-27984date:2023-03-24T16:41:08.100

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-341date:2023-03-16T00:00:00
db:CNVDid:CNVD-2023-29376date:2023-04-20T00:00:00
db:JVNDBid:JVNDB-2023-005630date:2023-11-09T00:00:00
db:CNNVDid:CNNVD-202303-1568date:2023-03-21T00:00:00
db:NVDid:CVE-2023-27984date:2023-03-21T11:15:10.553