CVE-2015-0997

published 2015-03-29

CVE-2015-0997: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface…

medium 5 CVSS 3.1

AV N AC L Au N C P I N A N

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
aveva	aveva_edge	< 7.1.3.4	7.1.3.4
schneider-electric	wonderware_intouch_2014	< 7.1	7.1

CWE-200