CVE-2014-2380：详情

Schneider Electric Wonderware Inadequate Encryption Strength

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.

Schneider Electric has created an update for WIS web pages and components to address the vulnerabilities listed in this advisory. Customers using all versions of WIS are affected and should upgrade to WIS Version 5.5 and then apply the security update. Customers using the affected versions of WIS should set the security level settings in the Internet browser to “Medium – High” to minimize the risks presented by these vulnerabilities. In addition, the Wonderware Information Server Portal can be configured to use HTTPS that will require additional steps as documented in the products user documentation. Schneider Electric has released a security bulletin titled “Multiple Vulnerabilities in Wonderware Information Server LFSEC00000102” to announce the security update, which is available at the following location: https://gcsresource.invensys.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000102.pdf

相关弱点

指标

EPSS

EPSS 评分

EPSS 百分位

相关产品

配置 0

Invensys>>Wonderware_information_server >> Version 4.0

Invensys>>Wonderware_information_server >> Version 4.0

Invensys>>Wonderware_information_server >> Version 4.5

Invensys>>Wonderware_information_server >> Version 5.0

Invensys>>Wonderware_information_server >> Version 5.5

参考资料