CVE ID | |
CVSS SCORE | 5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N |
AFFECTED VENDORS |
Schneider Electric |
AFFECTED PRODUCTS |
U.motion Builder |
TREND MICRO CUSTOMER PROTECTION | Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['24383']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com |
VULNERABILITY DETAILS |
The specific flaw exists within css.inc.php. The 'css' parameter contains a directory traversal vulnerability. An attacker can leverage this to disclose files. |
ADDITIONAL DETAILS |
03/29/2016 - ZDI disclosed the vulnerability reports to ICS-CERT (with an expected 'due date' of 07/27/16). -- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx and numerous other Microsoft Knowledge Base articles.
|
DISCLOSURE TIMELINE |
|
CREDIT | rgod |