CVE-2018-7841

high-risk
Published 2019-05-22

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Do I need to act?

!
55.5% chance of exploitation in next 30 days
EPSS score — higher than 44% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
46846
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Schneider-Electric

References (7)

Exploit http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-...
Exploit http://seclists.org/fulldisclosure/2019/May/26
Vendor Advisory https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
Exploit http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-...
Exploit http://seclists.org/fulldisclosure/2019/May/26
Vendor Advisory https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-...
62
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 25/34 · High
Exposure 5/34 · Minimal