A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf - Patch, Vendor Advisory |
24 Mar 2023, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf - Patch, Vendor Advisory | |
| First Time |
Schneider-electric
Schneider-electric custom Reports Schneider-electric igss Data Server Schneider-electric igss Dashboard |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:a:schneider-electric:custom_reports:*:*:*:*:*:*:*:* cpe:2.3:a:schneider-electric:igss_dashboard:*:*:*:*:*:*:*:* cpe:2.3:a:schneider-electric:igss_data_server:*:*:*:*:*:*:*:* |
Information
Published : 2023-03-21 09:15
Updated : 2024-11-21 07:53
NVD link : CVE-2023-27978
Mitre link : CVE-2023-27978
CVE.ORG link : CVE-2023-27978
JSON object : View
Products Affected
schneider-electric
- igss_data_server
- igss_dashboard
- custom_reports
CWE
CWE-502
Deserialization of Untrusted Data