CVE-2024-8401 — Schneider Electric / EcoStruxure Power Monitoring Expert (PME) 2021

Description (CNA)

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure Power Monitoring Expert (PME) 2021	affected 2021 CU1 and prior
Schneider Electric / EcoStruxure Power Monitoring Expert (PME) 2020	affected 2020 CU3 and prior
Schneider Electric / EcoStruxure Power Operation (EPO) 2022	affected CU4 and prior
Schneider Electric / EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module	affected CU4 and prior
Schneider Electric / EcoStruxure Power Operation (EPO) 2021	affected CU4 and prior
Schneider Electric / EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module	affected CU3 with Hotfix 2 and prior
Schneider Electric / EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module	affected All Versions

CWE

CWE-79

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-254-02.pdf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.