Schneider Electric Wonderware Information Server CVE-2014-5398 Information Disclosure Vulnerability

Bugtraq ID:	69417
Class:	Design Error
CVE:	CVE-2014-5398
Remote:	No
Local:	Yes
Published:	Aug 26 2014 12:00AM
Updated:	Aug 26 2014 12:00AM
Credit:	Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team
Vulnerable:	Invensys Wonderware Information Server 4.5 Portal Invensys Wonderware Information Server 4.0 SP1
Not Vulnerable:

Schneider Electric Wonderware Information Server CVE-2014-5398 Information Disclosure Vulnerability

Schneider Electric Wonderware Information Server is prone to a local information-disclosure vulnerability.

A local attacker can exploit this issue to obtain sensitive information; other attacks may also be possible.

The following versions are vulnerable:

Wonderware Information Server 4.0 SP1
Wonderware Information Server 4.5 Portal
Wonderware Information Server 5.0 Portal
Wonderware Information Server 5.5 Portal

Schneider Electric Wonderware Information Server CVE-2014-5398 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Schneider Electric Wonderware Information Server CVE-2014-5398 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Schneider Electric Wonderware Information Server CVE-2014-5398 Information Disclosure Vulnerability

References: