CVE-2018-7783
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
Schneider Electric SoMachine Basic en versiones anteriores a la v1.6 SP1 sufre una vulnerabilidad XXE (XML External Entity) mediante la técnica de entidades de parámetros DTD, resultando en la revelación y recuperación de datos arbitrarios en el nodo afectado mediante un ataque OOB (out-of-band). La vulnerabilidad se desencadena cuando la entrada pasada al analizador xml no se sanea cuando se analiza el archivo de proyecto/plantilla xml.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-03-08 CVE Reserved
- 2018-07-03 CVE Published
- 2023-03-07 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01 | 2022-01-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Schneider-electric Search vendor "Schneider-electric" | Somachine Basic Search vendor "Schneider-electric" for product "Somachine Basic" | <= 1.6 Search vendor "Schneider-electric" for product "Somachine Basic" and version " <= 1.6" | - |
Affected
| ||||||