Actively exploited · Published May 22, 2019 · Assigned by schneider
CVE-2018-7841
Critical 9.8 Exploited
In plain English
A critical-severity SQL injection in U.motion Builder software version 1.3.4 from U.motion. Attackers are actively exploiting it in the wild (listed by CISA on April 15, 2022). The chance it is exploited in the next 30 days is estimated at 72.5% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by May 6, 2022.
Official description
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| U.motion | U.motion Builder software version 1.3.4 | U.motion Builder software version 1.3.4 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html x_refsource_MISC
- 20190514 [CVE-2018-7841] Schneider Electric U.Motion Builder <= 1.3.4 track_import_export.php object_id Unauthenticated Command Injection mailing-list, x_refsource_FULLDISC
- https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7841 government-resource