CVE-2015-0999

CWE-200 — Information Exposure4 documents4 sources

Severity

2.1LOW

EPSS

0.1%

top 80.81%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Aveva Aveva Edge Schneider-electric Wonderware Intouch 2014

Timeline

PublishedMar 29

Latest updateMay 13

Description

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.

CVSS vector

AV:L/AC:L/C:P/I:N/A:NExploitability: 3.9 | Impact: 2.9

Affected Packages2 packages

▶NVDschneider-electric/wonderware_intouch_2014< 7.1.3.4

▶NVDaveva/aveva_edge< 7.1.3.4

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

GHSA

GHSA-w5xj-jgc6-7cv5: Schneider Electric InduSoft Web Studio before 7↗2022-05-13

▶

CVEList

CVE-2015-0999: Schneider Electric InduSoft Web Studio before 7↗2015-03-29

▶

💥Exploits & PoCs

Exploit-DB

Sendio ESP - Information Disclosure↗2015-05-26

▶