CVE-2017-5156

High

Published: 20/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. An attacker can forge a client request from a different site, allowing access to internal RDP systems on behalf of the currently logged in user.

Risk Assessment

The organization is at risk of unauthorized access to internal systems, which may lead to data breaches or unauthorized actions within the system.

Recommendation

It is recommended to update to the latest version of the software and implement CSRF protection mechanisms to minimize the risk of attacks.

Other vulnerabilities in Schneider Electric Wonderware InTouch Access Anywhere

CVE-2017-5158Critical
An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters.

Original NVD description (English source)

A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.