description: A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)
problem types: CWE-117 Improper Output Neutralization for Logs
affected:
{
defaultStatus: unaffected
product: EcoStruxure Geo SCADA Expert 2019
vendor: Schneider Electric
versions:
lessThanOrEqual: October 2022, status: affected, version: All, versionType: custom
}
{
defaultStatus: unaffected
product: EcoStruxure Geo SCADA Expert 2020
vendor: Schneider Electric
versions:
lessThanOrEqual: October 2022, status: affected, version: All, versionType: custom
}
{
defaultStatus: unaffected
product: EcoStruxure Geo SCADA Expert 2021
vendor: Schneider Electric
versions:
lessThanOrEqual: October 2022, status: affected, version: All , versionType: custom
}
{
defaultStatus: unaffected
product: ClearSCADA
vendor: Schneider Electric
versions:
status: affected, version: All  Versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL