Authentication Flaw in Schneider Electric’s Logcapture Feature

CVE-2024-8530

Summary

A significant vulnerability has been identified in Schneider Electric’s Logcapture feature, categorized as missing authentication for critical function (CWE-306). This flaw potentially exposes sensitive user data when unauthorized individuals can directly access previously generated 'logcaptures' archives via HTTPS. Organizations utilizing affected versions of Logcapture must take immediate action to apply necessary security patches and enhance their authentication protocols to mitigate risks associated with unauthorized data exposure.

References