CVE-2020-7570 : What You Need to Know

A CWE-79 vulnerability in EcoStruxure Building Operation WebReports V1.9 - V3.1 allows an authenticated remote user to execute a Cross-Site Scripting stored attack.

Understanding CVE-2020-7570

What is CVE-2020-7570?

This CVE identifies a CWE-79 vulnerability in EcoStruxure Building Operation WebReports V1.9 - V3.1 that enables an authenticated remote user to inject arbitrary web script or HTML, potentially leading to a Cross-Site Scripting stored attack.

The Impact of CVE-2020-7570

The vulnerability could allow attackers to execute malicious scripts within the context of other WebReport users, compromising data integrity and potentially leading to further attacks.

Technical Details of CVE-2020-7570

Vulnerability Description

The issue stems from improper neutralization of input during web page generation, specifically in the handling of user-supplied data, which lacks proper sanitization.

Affected Systems and Versions

Product: EcoStruxure Building Operation WebReports V1.9 - V3.1

Exploitation Mechanism

Attackers can exploit this vulnerability by injecting malicious web scripts or HTML code through user-supplied data, taking advantage of the lack of proper sanitization.

Mitigation and Prevention

Immediate Steps to Take

Apply security patches provided by the vendor
Implement input validation mechanisms to sanitize user-supplied data
Monitor and restrict user input to prevent malicious script injection

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities
Conduct security training for users to raise awareness about safe coding practices

Patching and Updates

Schneider Electric may release patches or updates to address this vulnerability. Stay informed through official channels for patch availability and deployment.