Vulnerability · Published Nov 15, 2023 · Assigned by schneider
CVE-2023-5986
High 8.2
In plain English
A high-severity open redirect in EcoStruxure Power Monitoring Expert (PME) from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.5%top 60.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure Power Monitoring Expert (PME) | Version 2020 CU2 and priorVersion 2021 CU1 and prior |
| Schneider Electric | EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards Module | Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021Advanced Reporting and Dashboards Module 2020 prior to CU3 |
| Schneider Electric | EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module | EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N