CVE-2023-5986 — Schneider Electric / EcoStruxure Power Monitoring Expert (PME)

Description (CNA)

A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure Power Monitoring Expert (PME)	affected Version 2020 CU2 and prior; affected Version 2021 CU1 and prior
Schneider Electric / EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards Module	affected Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021; affected Advanced Reporting and Dashboards Module 2020 prior to CU3
Schneider Electric / EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module	affected EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2

CWE

CWE-601

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-02.pdf

ADP enrichment

CVE

No English description supplied.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-02.pdf

CISA-ADP

No English description supplied.

No references supplied.