Wonderware Historian Client CVE-2017-7907 Local XML External Entity Injection Vulnerability

Bugtraq ID:	98254
Class:	Input Validation Error
CVE:	CVE-2017-7907
Remote:	No
Local:	Yes
Published:	May 02 2017 12:00AM
Updated:	May 18 2017 04:17PM
Credit:	Andrey Zhukov from USSC
Vulnerable:	Schneider-Electric Wonderware Historian Client 9.5 Schneider-Electric Wonderware Historian Client 2014 R2 SP1 Schneider-Electric Wonderware Historian Client 2014 R2 Schneider-Electric Wonderware Historian Client 10.1 Schneider-Electric Wonderware Historian Client 10.0 SP2 Schneider-Electric Wonderware Historian Client 10.0 SP1 Schneider-Electric Wonderware Historian Client 10.0
Not Vulnerable:

Wonderware Historian Client CVE-2017-7907 Local XML External Entity Injection Vulnerability

Wonderware Historian Client is prone to a local XML External Entity injection vulnerability.

A local attacker can exploit this issue to gain access to sensitive information or cause a denial-of-service condition.

Wonderware Historian Client 2014 R2 SP1 and prior are vulnerable.

Wonderware Historian Client CVE-2017-7907 Local XML External Entity Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Wonderware Historian Client CVE-2017-7907 Local XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.