Schneider Electric U.motion Builder up to 1.3.3 update_module.php update_file information disclosure

Summaryinfo

A vulnerability labeled as critical has been found in Schneider Electric U.motion Builder up to 1.3.3. This affects an unknown part of the file update_module.php. Executing a manipulation of the argument update_file as part of Parameter can lead to information disclosure. This vulnerability appears as CVE-2018-7776. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Schneider Electric U.motion Builder up to 1.3.3 (Automation Software) and classified as critical. This vulnerability affects an unknown part of the file update_module.php. The manipulation of the argument update_file as part of a Parameter leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.

The bug was discovered 04/19/2018. The weakness was presented 07/03/2018 (Website). The advisory is available at schneider-electric.com. This vulnerability was named CVE-2018-7776 since 03/08/2018. The attack can be initiated remotely. A single authentication is necessary for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 75 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:update_module.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.3.4 eliminates this vulnerability.

See VDB-120285, VDB-120286, VDB-120287 and VDB-120288 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Automation Software

Vendor

• Schneider Electric

Name

• U.motion Builder

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3

License

• commercial

Website

• Vendor: https://www.schneider-electric.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion