{"schemaVersion":3,"id":"CVE-2018-7783","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.","dates":{"published":"2018-07-03T14:00:00.000Z","modified":"2024-09-16T21:02:18.009Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0156,"percentile":0.74869,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0156},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01365,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0156,"percentile":0.74869}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01365,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0156,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0156,"percentile":0.74869}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"schneider electric se","product":"somachine basic","name":"SoMachine Basic","label":"somachine basic","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"SoMachine Basic prior to v1.6 SP1","noFixRecorded":false,"fixedIn":null}],"versionsText":"SoMachine Basic prior to v1.6 SP1","eol":null,"hubHref":"/vendor/schneider_electric_se/somachine_basic"},{"vendor":"schneider-electric","product":"somachine_basic","name":"somachine basic","label":"somachine_basic","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.6","eol":null,"hubHref":"/vendor/schneider-electric/somachine_basic"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/","label":"www.schneider-electric.com/en/download/document/SEVD-2018-142-01/","hostname":"www.schneider-electric.com","tags":["X Refsource CONFIRM","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-07-03T14:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T21:02:18.009Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:41:38.881Z","stale":false,"partial":false}}