Schneider Electric Webreports vulnerabilities

5 CVEs affecting Schneider Electric Webreports, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7573, published 2020-11-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-7569, published 2020-11-19. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to…
CVE-2020-7572, published 2020-11-19. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able…
CVE-2020-7573, published 2020-11-19. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due…
CVE-2020-7571, published 2020-11-19. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could…
CVE-2020-7570, published 2020-11-19. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an…