CVE-2023-5986

State: Published
Severity: 8.2 High
Published: Nov 15, 2023
Updated: Dec 2, 2024
Reserved: Nov 7, 2023

Description

A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N	schneider

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
EcoStruxure Power Monitoring Expert (PME)Schneider Electric	Version 2020 CU2 and priorAffected Version 2021 CU1 and priorAffected
EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards ModuleSchneider Electric	Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021Affected Advanced Reporting and Dashboards Module 2020 prior to CU3Affected
EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards ModuleSchneider Electric	EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2Affected

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-02.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.