CVE-2018-7807

8.8HIGH

Key Information:

Vendor
Schneider Electric
Status
Data Center Expert Versions 7.5.0 And Earlier
Vendor
CVE Published:
30 November 2018

Summary

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.

Affected Version(s)

Data Center Expert 7.5.0 and earlier Data Center Expert versions 7.5.0 and earlier

References

https://help.ecostruxureit.com/display/public/UADCE725/Se...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.