CVE-2013-0663

Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf	US Government Resource
http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/	Vendor Advisory
http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper	Vendor Advisory
https://www.exploit-db.com/exploits/44678/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:schneider-electric:modicon_quantum_plc:140noe77101:::::::*
	cpe:2.3:h:schneider-electric:modicon_quantum_plc:140noe77111:::::::*
	cpe:2.3:h:schneider-electric:modicon_quantum_plc:140nwm10000:::::::*

Configuration 2 (hide)

OR	cpe:2.3:h:schneider-electric:modicon_m340:bmxnoc0401:::::::*
	cpe:2.3:h:schneider-electric:modicon_m340:bmxnoe011xx:::::::*
	cpe:2.3:h:schneider-electric:modicon_m340:bmxnoe0100x:::::::*

Configuration 3 (hide)

OR	cpe:2.3:h:schneider-electric:modicon_premium:tsxety4103:::::::*
	cpe:2.3:h:schneider-electric:modicon_premium:tsxety5103:::::::*
	cpe:2.3:h:schneider-electric:modicon_premium:tsxwmy100:::::::*

History

No history.

Information

Published : 2013-04-04 11:58

Updated : 2018-05-24 01:29

NVD link : CVE-2013-0663

Mitre link : CVE-2013-0663

CVE.ORG link : CVE-2013-0663

JSON object : View

Products Affected

schneider-electric

modicon_premium
modicon_m340
modicon_quantum_plc

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2013-0663", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-04-04T11:58:48.687", "references": [{"url": "http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.exploit-db.com/exploits/44678/", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials."}, {"lang": "es", "value": "Vulnerabilidad CSRF en los m\u00f3dulos Schneider Electric Quantum 140NOE77111, 140NOE77101, y 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, y BMXNOE011xx; y Premium TSXETY4103, TSXETY5103, y TSXWMY100 PLC, permite a atacantes remotos secuestrar la autenticaci\u00f3n de los usuarios para peticiones que ejecutan comandos, como se ha demostrado mediante la modificaci\u00f3n de de peticiones HTTP."}], "lastModified": "2018-05-24T01:29:00.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_quantum_plc:140noe77101:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18705050-B954-4AB9-A8D0-BDCB09A9839A"}, {"criteria": "cpe:2.3:h:schneider-electric:modicon_quantum_plc:140noe77111:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56FB594F-638A-4E8B-9072-475E64CDE999"}, {"criteria": "cpe:2.3:h:schneider-electric:modicon_quantum_plc:140nwm10000:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD53FEBF-FF81-4563-B80C-CE67ABDA233B"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_m340:bmxnoc0401:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C02342-50B0-4883-9430-9CAB7968081B"}, {"criteria": "cpe:2.3:h:schneider-electric:modicon_m340:bmxnoe011xx:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21E85599-1298-4B8C-8255-42D165F905F4"}, {"criteria": "cpe:2.3:h:schneider-electric:modicon_m340:bmxnoe0100x:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F41B43D-038F-4775-A1BB-486918806E7E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_premium:tsxety4103:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEEA7CF9-59A9-4B40-9E20-F179D40815C9"}, {"criteria": "cpe:2.3:h:schneider-electric:modicon_premium:tsxety5103:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7579763-6663-41F7-A162-5FEBA9A9CE70"}, {"criteria": "cpe:2.3:h:schneider-electric:modicon_premium:tsxwmy100:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42C34DAA-D856-4E59-A98F-2DF47E600612"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}