CVE-2023-5629 : A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability

A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over HTTP.

Published 2023-12-14 05:15:12

Updated 2023-12-27 18:45:15

Source Schneider Electric SE

View at NVD, CVE.org

Vulnerability category: Open redirect

Products affected by CVE-2023-5629

Schneider-electric » Eb450 Firmware » Version: N/A
cpe:2.3:o:schneider-electric:eb450_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Eb450 » Version: N/A
Schneider-electric » Eb45e Firmware » Version: N/A
cpe:2.3:o:schneider-electric:eb45e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Eb45e » Version: N/A
Schneider-electric » Eh450 Firmware » Version: N/A
cpe:2.3:o:schneider-electric:eh450_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Eh450 » Version: N/A
Schneider-electric » Eh45e Firmware » Version: N/A
cpe:2.3:o:schneider-electric:eh45e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Eh45e » Version: N/A
Schneider-electric » Er450 Firmware » Version: N/A
cpe:2.3:o:schneider-electric:er450_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Er450 » Version: N/A
Schneider-electric » Er45e Firmware » Version: N/A
cpe:2.3:o:schneider-electric:er45e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Er45e » Version: N/A
Schneider-electric » Jr240 Firmware » Version: N/A
cpe:2.3:o:schneider-electric:jr240_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Jr240 » Version: N/A
Schneider-electric » Jr900 Firmware » Version: N/A
cpe:2.3:o:schneider-electric:jr900_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Jr900 » Version: N/A
Schneider-electric » Qr450 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qr450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qr450 » Version: N/A
Schneider-electric » Qr150 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qr150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qr150 » Version: N/A
Schneider-electric » Qb450 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qb450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qb450 » Version: N/A
Schneider-electric » Qb150 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qb150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qb150 » Version: N/A
Schneider-electric » Qp450 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qp450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qp450 » Version: N/A
Schneider-electric » Qp150 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qp150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qp150 » Version: N/A
Schneider-electric » Qh450 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qh450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qh450 » Version: N/A
Schneider-electric » Qh150 Firmware
Versions before (<) 2.7.0
cpe:2.3:o:schneider-electric:qh150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Qh150 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-5629

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-5629

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N	2.8	4.7	Schneider Electric SE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-5629

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Assigned by: cybersecurity@se.com (Primary)

References for CVE-2023-5629

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-346-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-346-01.pdf

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-5629

Products affected by CVE-2023-5629

Exploit prediction scoring system (EPSS) score for CVE-2023-5629

CVSS scores for CVE-2023-5629

CWE ids for CVE-2023-5629

References for CVE-2023-5629