Paper/Archive/CVE-2018-7841

CVE-2018-7841

U.motion U.motion Builder software version 1.3.4 — Schneider Electric U.motion Builder SQL Injection Vulnerability

KEV · due 6 May EPSS 72%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.4.994 × 2019.9 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Affected

ProductAffectedFixed inSource

U.motion Builder software version 1.3.4U.motion Builder software version 1.3.4–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refpacketstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html refseclists.org/fulldisclosure/2019/May/26 refschneider-electric.com/ww/en/download/document/SEVD-2019-071-02 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7841 kevcisa.gov/known-exploited-vulnerabilities-catalog