description:
A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input
attackers can cause the software’s web application to redirect to the chosen domain after a
successful login is performed.
problem types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
affected:
{
defaultStatus: unaffected
product: EcoStruxure Power Monitoring Expert (PME)
vendor: Schneider Electric
versions:
status: affected, version: Version 2020 CU2 and prior
status: affected, version: Version 2021 CU1 and prior
}
{
defaultStatus: unaffected
product: EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards Module
vendor: Schneider Electric
versions:
status: affected, version: Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021
status: affected, version: Advanced Reporting and Dashboards Module 2020 prior to CU3
}
{
defaultStatus: unaffected
product: EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module
vendor: Schneider Electric
versions:
status: affected, version: EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL