CVE-2021-22704

{"id": "CVE-2021-22704", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2021-09-02T17:15:08.060", "references": [{"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP."}, {"lang": "es", "value": "Una CWE-22: Una vulnerabilidad de Limitaci\u00f3n Inapropiada de un Nombre de Ruta a un Directorio Restringido se presenta en los productos Harmony/HMI Configurados por Vijeo Designer (todas las versiones anteriores a V6.2 SP11 ), Vijeo Designer Basic (todas las versiones anteriores a V1.2) o EcoStruxure Machine Expert (todas las versiones anteriores a V2.0) que podr\u00eda causar una denegaci\u00f3n de servicio o un acceso no autorizado a la informaci\u00f3n del sistema cuando se conecta al Harmony HMI a trav\u00e9s de FTP"}], "lastModified": "2021-09-20T12:06:54.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5F2F861-8F3B-40B0-9CC4-DB9776052C7A", "versionEndExcluding": "6.2.11"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:harmony_gk:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FDBAEC72-A63C-464D-8E62-C42959D4A871"}, {"criteria": "cpe:2.3:h:schneider-electric:harmony_gto:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3DDF1060-1FF5-41D5-A8ED-129492CC50A4"}, {"criteria": "cpe:2.3:h:schneider-electric:harmony_gtu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9FCFA535-319D-4AB7-AB6C-B4BB0739B7F4"}, {"criteria": "cpe:2.3:h:schneider-electric:harmony_gtux:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AEA285A2-8EA7-473D-87A5-62E970BD25C3"}, {"criteria": "cpe:2.3:h:schneider-electric:harmony_sto:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "68382B8C-4FB2-49AC-8CAE-2251400BE342"}, {"criteria": "cpe:2.3:h:schneider-electric:harmony_stu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EB2002BD-8A77-414F-A530-A7D9350143F5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:basic:*:*:*", "vulnerable": true, "matchCriteriaId": "B69EE5F8-4732-4019-BEE4-D80CFCD31FF7", "versionEndExcluding": "1.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:harmony_gxu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ED64924A-493F-48DB-B547-0D2FF7C3C9FE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4DB52BF-192B-4167-872E-AAEC81ACAE7F", "versionEndExcluding": "2.0"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25030153-0F86-4598-984C-897A7BB33B48"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:harmony_scu:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4BE5BC10-3788-4CC2-BEC9-F07350793F3E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@se.com"}