CVE-2023-37196

A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unauthorized actions when tampering with the alert settings of endpoints on DCE.

Score

CVSS 3.1 8.8 High

Status

Modified - cybersecurity@se.com

Published

2023-07-12

Last modified

2024-11-07

Weaknesses

CWE-89

Affected products

• Struxureware Data Center Expert (Schneider-electric)
• Struxureware Data Center Expert (Schneider Electric)

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_…