CVE-2023-27981: Path Traversal

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2023-27981.

Q: What is the severity of CVE-2023-27981?

The severity of CVE-2023-27981 is high.

Q: What is the CWE number associated with CVE-2023-27981?

The CWE number associated with CVE-2023-27981 is CWE-22.

Q: Which products are affected by CVE-2023-27981?

The affected products are Schneider-electric Custom Reports, Schneider-electric Igss Dashboard, and Schneider-electric Igss Data Server.

Q: How can CVE-2023-27981 be exploited?

CVE-2023-27981 can be exploited by opening a malicious report in Custom Reports.

Published Mar 21, 2023

Updated

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).

Affected Software

3 affected components

Schneider-electric Custom Reports<=16.0.0.23040

Schneider-electric Igss Dashboard<=16.0.0.23040

Schneider-electric Igss Data Server<=16.0.0.23040

Remediation

Patch Available

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-04.pdf

Event History

Mar 21, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2023-27981.

What is the severity of CVE-2023-27981?

The severity of CVE-2023-27981 is high.

What is the CWE number associated with CVE-2023-27981?