CVE-2014-5399
HighSummary
CVE-2014-5399 is an SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Risk Assessment
Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information or data modification.
Recommendation
It is recommended to upgrade to the latest version of the software that includes security patches and to implement additional protective measures such as input validation.
Other vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 to 5.5
See all- CVE-2014-5397High
The XSS vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.
- CVE-2014-2380High
Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 uses weak encryption, allowing remote attackers to obtain sensitive information by reading a credential file.
Original NVD description (English source)
SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.