CVEvulnerability
CVE-2017-5158
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-04-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.
Affected configurations
• aveva wonderware intouch access anywhere (<= 11.5.2)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/ Vendor Advisory
- http://www.securityfocus.com/bid/97256 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01 Third Party Advisory, US Government Resource
- http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114/ Vendor Advisory
- http://www.securityfocus.com/bid/97256 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01 Third Party Advisory, US Government Resource