CVE-2017-7973

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cybersecurity@se.com

Published

2017-09-26

Last modified

2024-09-16

Weaknesses

CWE-89

Affected products

• U.motion Builder (Schneider-electric)
• U.motion (Schneider Electric Se)

References

• http://www.schneider-electric.com/en/download/document/SEVD-2017-178-01/
• http://www.securityfocus.com/bid/99344