CVE-2023-3001

high · 7.8

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.

7.8

CVSS

31.9%

EPSS (exploit prob.)

98th

EPSS percentile

2023-06-14

Published

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
schneider-electric	igss_dashboard	< 16.0.0.23131

Check a specific version with /api/v1/cve/match.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-02.pdf
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-02.pdf

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-3001