CVE-2017-7973: SQL Injection
Published Sep 25, 2017
·Updated
A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated user can use calls to various paths allowing performance of arbitrary SQL commands against the underlying database.
Affected Software
1 affected component
Schneider-electric U.motion Builder<=1.2.1
Event History
Sep 25, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-7973?
CVE-2017-7973 is classified as a critical SQL injection vulnerability.
2
How do I fix CVE-2017-7973?
To address CVE-2017-7973, upgrade to Schneider Electric's U.motion Builder version 1.2.2 or later.
3
Who is affected by CVE-2017-7973?
CVE-2017-7973 affects users of Schneider Electric's U.motion Builder software versions 1.2.1 and earlier.
4
What type of attack can be executed via CVE-2017-7973?
CVE-2017-7973 allows an unauthenticated user to execute arbitrary SQL commands against the underlying database.
5
What software is associated with CVE-2017-7973?
CVE-2017-7973 is associated with Schneider Electric's U.motion Builder software.