CVE-2023-37197 — Schneider Electric / StruxureWare Data Center Expert

Description (CNA)

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the mass configuration settings of endpoints on DCE.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / StruxureWare Data Center Expert	affected v7.9.3 and earlier

CWE

CWE-89

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf

ADP enrichment

CVE

No English description supplied.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf

CISA-ADP

No English description supplied.

No references supplied.