CVE-2023-27979

published 2023-03-21

CVE-2023-27979: A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project…

medium 6.5 CVSS 3.1

AV N AC L PR N UI N S U C N I L A L

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial of service when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	custom_reports	<= 16.0.0.23040	—
schneider-electric	igss_dashboard	<= 16.0.0.23040	—
schneider-electric	igss_data_server	<= 16.0.0.23040	—
schneider_electric	custom_reports	V – 16.0.0.23040	—
schneider_electric	igss_dashboard	V – 16.0.0.23040	—
schneider_electric	igss_data_server	V – 16.0.0.23040	—

CWE-345