CVE-2023-27977
Last modified
CVE-2023-27977 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss of data when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss of data when an attacker sends specific crafted messages to the Data Server TCP port. Affected Products: IGSS Data Server(IGSSdataServer.exe)(V16.0.0.23040 and prior), IGSS Dashboard(DashBoard.exe)(V16.0.0.23040 and prior), Custom Reports(RMS16.dll)(V16.0.0.23040 and prior).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Custom Reports | <= 16.0.0.23040 |
| Schneider-Electric | Igss Dashboard | <= 16.0.0.23040 |
| Schneider-Electric | Igss Data Server | <= 16.0.0.23040 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-27977?
How severe is CVE-2023-27977?
How do I fix CVE-2023-27977?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-27971Certain HP LaserJet Pro print products are potentially vulne…9.8
- CVE-2023-27972Certain HP LaserJet Pro print products are potentially vulne…9.8
- CVE-2023-27973Certain HP LaserJet Pro print products are potentially vulne…9.8
- CVE-2023-27974Bitwarden through 2023.2.1 offers password auto-fill when th…7.5
- CVE-2023-27975 CWE-522: Insufficiently Protected Credentials vulnerability…7.1
- CVE-2023-27976 A CWE-668: Exposure of Resource to Wrong Sphere vulnerabili…8.8
- CVE-2023-27978A CWE-502: Deserialization of Untrusted Data vulnerability e…7.8
- CVE-2023-27979A CWE-345: Insufficient Verification of Data Authenticity vu…6.5
- CVE-2023-2798Those using HtmlUnit to browse untrusted webpages may be vul…7.5
- CVE-2023-27980A CWE-306: Missing Authentication for Critical Function vuln…8.8
- CVE-2023-27981A CWE-22: Improper Limitation of a Pathname to a Restricted …8.8
- CVE-2023-27982A CWE-345: Insufficient Verification of Data Authenticity vu…8.8
Are you affected by CVE-2023-27977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST