CVE-2018-7783: schneider electric se somachine basic

Vulnerability summary

CVE-2018-7783 is a high (CVSS 7.5) vulnerability in schneider electric se somachine basic. EPSS estimates a 1.56% chance of exploitation in the next 30 days, higher than 74.8% of scored vulnerabilities.

Timeline

1. 03-07-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.