Schneider Electric PowerSCADA Anywhere 1.0 Secure Gateway cross-site request forgery

entryeditHistoryDiffjsonxmlCTI

A vulnerability, which was classified as problematic, has been found in Schneider Electric PowerSCADA Anywhere 1.0 (SCADA Software). Affected by this issue is an unknown part of the component Secure Gateway. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
10820018	01/14/2021	VulD...	cvss2_nvd_basescore	6.8	nist.gov	01/14/2021	accepted	90
10820017	01/14/2021	VulD...	person_name	Schneider Electric	securityfocus.com	01/14/2021	accepted	70
7139814	11/19/2019	VulD...	confirm_url	http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/	schneider-electric.com	11/19/2019	accepted	100
7139774	11/19/2019	VulD...	discoverydate	1500508800		11/19/2019	accepted	100
7139833	09/26/2017	VulD...	cvss3_nvd_basescore	8.8	nist.gov	09/26/2017	accepted	90
7139832	09/26/2017	VulD...	0day_days	67		09/26/2017	accepted	90
7139831	09/26/2017	VulD...	cvss3_vuldb_rc	X		09/26/2017	accepted	90
7139830	09/26/2017	VulD...	cvss3_vuldb_rl	X		09/26/2017	accepted	90
7139829	09/26/2017	VulD...	cvss3_vuldb_e	X		09/26/2017	accepted	90
7139828	09/26/2017	VulD...	cvss2_vuldb_rc	ND		09/26/2017	accepted	90
7139827	09/26/2017	VulD...	cvss2_vuldb_rl	ND		09/26/2017	accepted	90
7139826	09/26/2017	VulD...	cvss2_vuldb_e	ND		09/26/2017	accepted	90
7139825	09/26/2017	VulD...	location	Website		09/26/2017	accepted	90
7139824	09/26/2017	VulD...	seealso	107139 107140 107141 113181		09/26/2017	accepted	100
7139823	09/26/2017	VulD...	securityfocus_title	Schneider Electric PowerSCADA Anywhere and Citect Anywhere Multiple Security Vulnerabilities	securityfocus.com	09/26/2017	accepted	100
7139822	09/26/2017	VulD...	securityfocus_class	Unknown	securityfocus.com	09/26/2017	accepted	100
7139821	09/26/2017	VulD...	securityfocus_date	1500508800 (07/20/2017)	securityfocus.com	09/26/2017	accepted	100
7139820	09/26/2017	VulD...	securityfocus	99913	securityfocus.com	09/26/2017	accepted	100
7139819	09/26/2017	VulD...	cve_nvd_summary	A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.	mitre.org	09/26/2017	accepted	100
7139818	09/26/2017	VulD...	cve_nvd_published	1506297600	mitre.org	09/26/2017	accepted	100