CVE-2017-9637 Information disclosure in Ampla MES
An attacker can sniff SQL credentials from connection strings in Schneider Electric Ampla MES, exposing sensitive database access details.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9637?
CVE-2017-9637 is a medium-severity vulnerability in Schneider Electric SE Ampla MES, published on 18 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that users of Ampla MES versions 6.4 and prior should upgrade to Ampla MES version 6.5 as soon as possible.
Which versions are affected by CVE-2017-9637?
It affects 1 product.
Products include Schneider-Electric Ampla Manufacturing Execution System.
How do I fix CVE-2017-9637?
No fix has been published for CVE-2017-9637 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-9637 being exploited?
There is no known exploitation of CVE-2017-9637 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric SE Ampla MES
Sources
Also known as GHSA-95r6-hq2x-fm98.