CVE-2018-7797 Open redirect in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxureª Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxureª Energy Expert 1.3 (formerly Power Manager), EcoStruxureª Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxureª Power Monitoring Expert (PME) v9.0, EcoStruxureª Energy Expert v2.0, and EcoStruxureªPower SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module
Attackers can redirect users to malicious sites via URL redirection in Schneider Electric Power Monitoring Expert and Energy Expert, facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-7797?
CVE-2018-7797 is a medium-severity vulnerability in Schneider Electric SE Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxureª Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxureª Energy Expert 1.3 (formerly Power Manager), EcoStruxureª Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxureª Power Monitoring Expert (PME) v9.0, EcoStruxureª Energy Expert v2.0, and EcoStruxureªPower SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module, published on 17 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert 1.3 (formerly Power Manager), EcoStruxure Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxure Power Monitoring Expert (PME) v9.0, EcoStruxure Energy Expert v2.0, and EcoStruxure Power SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module which could cause a phishing attack when redirected to a malicious site.
Weakness: CWE-601
Which versions are affected by CVE-2018-7797?
It affects 3 products.
Products include Schneider-Electric Ecostruxure Energy Expert, Schneider-Electric Ecostruxure Power Monitoring Expert, Schneider-Electric Ecostruxure Power Scada Operation.
How do I fix CVE-2018-7797?
No fix has been published for CVE-2018-7797 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7797 being exploited?
There is no known exploitation of CVE-2018-7797 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric SE Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxureª Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxureª Energy Expert 1.3 (formerly Power Manager), EcoStruxureª Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxureª Power Monitoring Expert (PME) v9.0, EcoStruxureª Energy Expert v2.0, and EcoStruxureªPower SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module
- CVE-2020-7547 Privilege escalation in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)
- CVE-2020-7545 Missing authorization in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)
- CVE-2020-7546 Cross-site scripting in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)
Sources
Also known as GHSA-9p3j-xx7r-8mm9.