CVE-2017-9960

MEDIUM

Schneider Electric U.motion Builder <= 1.2.1 - Unauthenticated Sensitive Information Exposure via Error Response

Title source: llm
STIX 2.1

Description

An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error provides more information than should be available to an unauthenticated user.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99344

Scores

CVSS v3 5.3
EPSS 0.0024
EPSS Percentile 46.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (2)
Schneider Electric SE/U.Motion U.motion Builder Versions 1.2.1 and prior.
schneider-electric/u.motion_builder < 1.2.1
Published Sep 26, 2017
Tracked Since Feb 18, 2026