CVE-2014-5399 — Schneider Electric Wonderware SQL Injection

CVE-2014-5399

Schneider Electric Wonderware SQL Injection PUBLISHED

Description (CNA)

SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / Wonderware Information Server Portal	affected 4.0 SP1; affected 4.5; affected 5.0; affected 5.5

CWE

CWE-89

References

https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-02
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-238-02.json

ADP enrichment

CVE

No English description supplied.

https://ics-cert.us-cert.gov/advisories/ICSA-14-238-02
http://www.securityfocus.com/bid/69416