Lucene search

[email protected]NVD:CVE-2019-6837

HistorySep 17, 2019 - 8:15 p.m.

CVE-2019-6837

2019-09-1720:15:12

CWE-918

[email protected]

web.nvd.nist.gov

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could cause server configuration data to be exposed when an attacker modifies a URL.

Affected configurations

Nvd

Node

schneider-electricmeg6501-0001_firmwareRange<1.3.7

AND

schneider-electricmeg6501-0001Match-

Node

schneider-electricmeg6501-0002_firmwareRange<1.3.7

AND

schneider-electricmeg6501-0002Match-

Node

schneider-electricmeg6260-0410_firmwareRange<1.3.7

AND

schneider-electricmeg6260-0410Match-

Node

schneider-electricmeg6260-0415_firmwareRange<1.3.7

AND

schneider-electricmeg6260-0415Match-

VendorProductVersionCPE
schneider-electricmeg6501-0001_firmware*cpe:2.3:o:schneider-electric:meg6501-0001_firmware:*:*:*:*:*:*:*:*
schneider-electricmeg6501-0001-cpe:2.3:o:schneider-electric:meg6501-0001:-:*:*:*:*:*:*:*
schneider-electricmeg6501-0002_firmware*cpe:2.3:o:schneider-electric:meg6501-0002_firmware:*:*:*:*:*:*:*:*
schneider-electricmeg6501-0002-cpe:2.3:o:schneider-electric:meg6501-0002:-:*:*:*:*:*:*:*
schneider-electricmeg6260-0410_firmware*cpe:2.3:o:schneider-electric:meg6260-0410_firmware:*:*:*:*:*:*:*:*
schneider-electricmeg6260-0410-cpe:2.3:o:schneider-electric:meg6260-0410:-:*:*:*:*:*:*:*
schneider-electricmeg6260-0415_firmware*cpe:2.3:o:schneider-electric:meg6260-0415_firmware:*:*:*:*:*:*:*:*
schneider-electricmeg6260-0415-cpe:2.3:o:schneider-electric:meg6260-0415:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	meg6501-0001_firmware	*	cpe:2.3:o:schneider-electric:meg6501-0001_firmware::::::::
schneider-electric	meg6501-0001	-	cpe:2.3:o:schneider-electric:meg6501-0001:-:::::::*
schneider-electric	meg6501-0002_firmware	*	cpe:2.3:o:schneider-electric:meg6501-0002_firmware::::::::
schneider-electric	meg6501-0002	-	cpe:2.3:o:schneider-electric:meg6501-0002:-:::::::*
schneider-electric	meg6260-0410_firmware	*	cpe:2.3:o:schneider-electric:meg6260-0410_firmware::::::::
schneider-electric	meg6260-0410	-	cpe:2.3:o:schneider-electric:meg6260-0410:-:::::::*
schneider-electric	meg6260-0415_firmware	*	cpe:2.3:o:schneider-electric:meg6260-0415_firmware::::::::
schneider-electric	meg6260-0415	-	cpe:2.3:o:schneider-electric:meg6260-0415:-:::::::*

References

www.schneider-electric.com/ww/en/download/document/SEVD-2019-253-01

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

53.8%

JSON

Related for NVD:CVE-2019-6837

cve1 prion1 cvelist1