Vulnerability-Lookup

VAR-201409-0722

Vulnerability from variot - Updated: 2025-11-19 23:15

Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. ClearSCADA is an integrated SCADA host platform that includes a rotation training engine, real-time database, web server, alarm processor and reporting software. A cross-site scripting vulnerability exists in the ClearSCADA WEB interface that allows an attacker to exploit a vulnerability to construct a malicious URI, to induce user resolution, and to perform system management operations. Scada Expert Clearscada is prone to a cross-site scripting vulnerability. Schneider Electric StruxureWare SCADA Expert ClearSCADA is a set of energy efficiency management software monitoring platform of French Schneider Electric (Schneider Electric). The platform is primarily used for remote management of critical infrastructure

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201409-0722",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": null,
        "scope": "eq",
        "trust": 2.0,
        "vendor": "clearscada",
        "version": "2013"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "schneider electric",
        "version": "2014"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "clearscada",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "aveva",
        "version": "2013"
      },
      {
        "model": "clearscada",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "aveva",
        "version": "2010"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.8,
        "vendor": "clearscada",
        "version": "2010"
      },
      {
        "model": "clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2010 r3 (build 72.4560)"
      },
      {
        "model": "clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2010 r3.1 (build 72.4644)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2013 r1 (build 73.4729)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2013 r1.1 (build 73.4832)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2013 r1.1a (build 73.4903)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2013 r1.2 (build 73.4955)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2013 r2 (build 74.5094)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2013 r2.1 (build 74.5192)"
      },
      {
        "model": "scada expert clearscada",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "schneider electric",
        "version": "2014 r1 (build 75.5210)"
      },
      {
        "model": "electric clearscada r3 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201072.4560)"
      },
      {
        "model": "electric clearscada r3.1 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201072.4644)"
      },
      {
        "model": "electric scada expert clearscada r1 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201373.4729)"
      },
      {
        "model": "electric scada expert clearscada r1.1 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201373.4832)"
      },
      {
        "model": "electric scada expert clearscada r1.1a (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201373.4903)"
      },
      {
        "model": "electric scada expert clearscada r1.2 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201373.4955)"
      },
      {
        "model": "electric scada expert clearscada r2 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201374.5094)"
      },
      {
        "model": "electric scada expert clearscada r2.1 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201374.5192)"
      },
      {
        "model": "electric scada expert clearscada r1 (build",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider",
        "version": "201475.5210)"
      },
      {
        "model": "clearscada",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "schneider electric",
        "version": "2010"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "scada expert clearscada",
        "version": "2013"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.4,
        "vendor": "scada expert clearscada",
        "version": "2014"
      },
      {
        "model": "scada expert clearscada r1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2014"
      },
      {
        "model": "scada expert clearscada r2.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "scada expert clearscada r2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "scada expert clearscada r1.2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "scada expert clearscada r1.1a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "scada expert clearscada r1.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "scada expert clearscada r1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2013"
      },
      {
        "model": "clearscada r3.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2010"
      },
      {
        "model": "clearscada r3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "schneider electric",
        "version": "2010"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "BID",
        "id": "80073"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:schneider_electric:clearscada",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:schneider_electric:scada_expert_clearscada",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unknown",
    "sources": [
      {
        "db": "BID",
        "id": "80073"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-5411",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "id": "CVE-2014-5411",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "ics-cert@hq.dhs.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 4.9,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2014-5411",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "id": "CNVD-2014-06196",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "id": "770608ec-1eb9-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 0.2,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "IVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 0.2,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "id": "VHN-73352",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:S/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "ics-cert@hq.dhs.gov",
            "id": "CVE-2014-5411",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-5411",
            "trust": 1.0,
            "value": "LOW"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-5411",
            "trust": 0.8,
            "value": "Low"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-06196",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201409-656",
            "trust": 0.6,
            "value": "LOW"
          },
          {
            "author": "IVD",
            "id": "770608ec-1eb9-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "LOW"
          },
          {
            "author": "IVD",
            "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "LOW"
          },
          {
            "author": "VULHUB",
            "id": "VHN-73352",
            "trust": 0.1,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. ClearSCADA is an integrated SCADA host platform that includes a rotation training engine, real-time database, web server, alarm processor and reporting software. A cross-site scripting vulnerability exists in the ClearSCADA WEB interface that allows an attacker to exploit a vulnerability to construct a malicious URI, to induce user resolution, and to perform system management operations. Scada Expert Clearscada is prone to a cross-site scripting vulnerability. Schneider Electric StruxureWare SCADA Expert ClearSCADA is a set of energy efficiency management software monitoring platform of French Schneider Electric (Schneider Electric). The platform is primarily used for remote management of critical infrastructure",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "BID",
        "id": "80073"
      },
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      }
    ],
    "trust": 2.88
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-5411",
        "trust": 3.8
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-259-01",
        "trust": 3.4
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196",
        "trust": 1.0
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656",
        "trust": 1.0
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-259-01A",
        "trust": 1.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282",
        "trust": 0.8
      },
      {
        "db": "OSVDB",
        "id": "111238",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "80073",
        "trust": 0.4
      },
      {
        "db": "IVD",
        "id": "770608EC-1EB9-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "IVD",
        "id": "DCDEEBB0-2351-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "db": "BID",
        "id": "80073"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "id": "VAR-201409-0722",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      }
    ],
    "trust": 2.0027777833333333
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      }
    ]
  },
  "last_update_date": "2025-11-19T23:15:03.200000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "StruxureWare SCADA Expert ClearSCADA",
        "trust": 0.8,
        "url": "http://www.schneider-electric.com/products/ww/en/5100-software/5135-operating-monitoring/61264-struxureware-scada-expert-clearscada/?xtmc=ClearSCADA\u0026xtcr=1"
      },
      {
        "title": "Patch for Schneider Electric ClearSCADA Cross-Site Scripting Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/50244"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-14-259-01"
      },
      {
        "trust": 1.4,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5411"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-259-01a"
      },
      {
        "trust": 1.0,
        "url": "https://github.com/cisagov/csaf/blob/develop/csaf_files/ot/white/2014/icsa-14-259-01a.json"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5411"
      },
      {
        "trust": 0.6,
        "url": "http://osvdb.com/show/osvdb/111238"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "db": "BID",
        "id": "80073"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "db": "BID",
        "id": "80073"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-09-23T00:00:00",
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-09-23T00:00:00",
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-09-23T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "date": "2014-09-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "date": "2014-09-18T00:00:00",
        "db": "BID",
        "id": "80073"
      },
      {
        "date": "2014-09-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "date": "2014-09-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "date": "2014-09-18T10:55:11.640000",
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-09-23T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      },
      {
        "date": "2018-12-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-73352"
      },
      {
        "date": "2014-09-18T00:00:00",
        "db": "BID",
        "id": "80073"
      },
      {
        "date": "2014-09-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      },
      {
        "date": "2014-09-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-004282"
      },
      {
        "date": "2025-11-04T23:15:33.223000",
        "db": "NVD",
        "id": "CVE-2014-5411"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Schneider Electric ClearSCADA Cross-Site Scripting Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "770608ec-1eb9-11e6-abef-000c29c66e3d"
      },
      {
        "db": "IVD",
        "id": "dcdeebb0-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-06196"
      }
    ],
    "trust": 1.0
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-656"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-5411 (GCVE-0-2014-5411)

Vulnerability from cvelistv5 – Published: 2014-09-18 10:00 – Updated: 2025-11-04 22:53

Title

Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting

Summary

Severity

No CVSS data available.

CWE

CWE-79

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 349 records in the last 180 days details

References

3 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
https://github.com/cisagov/CSAF/blob/develop/csaf…
https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01	x_refsource_MISCx_transferred

Impacted products

2 products

Vendor	Product	Version
Schneider Electric	ClearSCADA	Affected: 2010 R3 (build 72.4560) Affected: 2010 R3.1 (build 72.4644) Unaffected: 2010 R3.2
Schneider Electric	SCADA Expert ClearSCADA	Affected: 2013 R1 (build 73.4729) Affected: 2013 R1.1 (build 73.4832) Affected: 2013 R1.1a (build 73.4903) Affected: 2013 R1.2 (build 73.4955) Affected: 2013 R2 (build 74.5094) Affected: 2013 R2.1 (build 74.5192) Affected: 2014 R1 (build 75.5210) Unaffected: 2014 R1.1

Date Public

2014-09-16 06:00

Credits

Aditya Sood

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:49.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ClearSCADA",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "2010 R3 (build 72.4560)"
            },
            {
              "status": "affected",
              "version": "2010 R3.1 (build 72.4644)"
            },
            {
              "status": "unaffected",
              "version": "2010 R3.2"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SCADA Expert ClearSCADA",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "2013 R1 (build 73.4729)"
            },
            {
              "status": "affected",
              "version": "2013 R1.1 (build 73.4832)"
            },
            {
              "status": "affected",
              "version": "2013 R1.1a (build 73.4903)"
            },
            {
              "status": "affected",
              "version": "2013 R1.2 (build 73.4955)"
            },
            {
              "status": "affected",
              "version": "2013 R2 (build 74.5094)"
            },
            {
              "status": "affected",
              "version": "2013 R2.1 (build 74.5192)"
            },
            {
              "status": "affected",
              "version": "2014 R1 (build 75.5210)"
            },
            {
              "status": "unaffected",
              "version": "2014 R1.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aditya Sood"
        }
      ],
      "datePublic": "2014-09-16T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMultiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.\u003c/p\u003e"
            }
          ],
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 4.9,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T22:53:17.900Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-259-01a"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-259-01a.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSchneider Electric advises all ClearSCADA users to take steps to \nsecure the interfaces to the ClearSCADA system. The ClearSCADA database \nsecurity configuration should be reviewed and updated to limit all \nsystem access to authorized users only. The access permissions of \nexisting users should be reduced to only those required by their role \n(e.g., removing any higher level System Administration privileges from \nOperations or Engineering users), and specific accounts should be \ncreated with appropriate permissions for performing System \nAdministration tasks.\u003c/p\u003e\n\u003cp\u003eExisting ClearSCADA customers using WebX can protect their system \nfrom cross-site scripting attacks by disabling the \u201cAllow database \nshutdown via WebX\u201d option within the ClearSCADA Server Configuration \nutility.\u003c/p\u003e\n\u003cp\u003eExisting ClearSCADA customers should take measures to ensure their \nsystem does not grant any system access until users have supplied a \nvalid username and password.\u003c/p\u003e\n\u003cp\u003eSchneider Electric has corrected the default user security \npermissions; however, upgrading an existing vulnerable installation to a\n new version will not affect existing configured database security \npermissions. Therefore, the measures suggested here are strongly \nrecommended for all users.\u003c/p\u003e\n\u003cp\u003eSchneider Electric has corrected these vulnerabilities in the following service packs:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eClearSCADA 2010 R3.2, Released October 2014, and\u003c/li\u003e\n\u003cli\u003eSCADA Expert ClearSCADA 2014 R1.1, Released October 2014.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIf asset owners wish to upgrade to a new ClearSCADA Service Pack, \nplease contact the local Schneider Electric office for the latest \nsoftware version for ClearSCADA; alternatively, these new versions are \navailable for direct download from the Schneider Electric web site. To \nupdate their license (not required when upgrading to a service pack of \nthe same version), asset owners are required to complete and submit an \nonline form, which is available here:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update+Request+Form\"\u003ehttp://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update...\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eNew Service packs for ClearSCADA are available for download here:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support\"\u003ehttp://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eGeneral instructions on how to upgrade the ClearSCADA license (if required) are available here:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://resourcecenter.controlmicrosystems.com/display/CS/Updating+Your+ClearSCADA+License\"\u003ehttp://resourcecenter.controlmicrosystems.com/display/CS/Updating+Your+ClearSCADA+License\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Schneider Electric advises all ClearSCADA users to take steps to \nsecure the interfaces to the ClearSCADA system. The ClearSCADA database \nsecurity configuration should be reviewed and updated to limit all \nsystem access to authorized users only. The access permissions of \nexisting users should be reduced to only those required by their role \n(e.g., removing any higher level System Administration privileges from \nOperations or Engineering users), and specific accounts should be \ncreated with appropriate permissions for performing System \nAdministration tasks.\n\n\nExisting ClearSCADA customers using WebX can protect their system \nfrom cross-site scripting attacks by disabling the \u201cAllow database \nshutdown via WebX\u201d option within the ClearSCADA Server Configuration \nutility.\n\n\nExisting ClearSCADA customers should take measures to ensure their \nsystem does not grant any system access until users have supplied a \nvalid username and password.\n\n\nSchneider Electric has corrected the default user security \npermissions; however, upgrading an existing vulnerable installation to a\n new version will not affect existing configured database security \npermissions. Therefore, the measures suggested here are strongly \nrecommended for all users.\n\n\nSchneider Electric has corrected these vulnerabilities in the following service packs:\n\n\n\n  *  ClearSCADA 2010 R3.2, Released October 2014, and\n\n  *  SCADA Expert ClearSCADA 2014 R1.1, Released October 2014.\n\n\n\n\nIf asset owners wish to upgrade to a new ClearSCADA Service Pack, \nplease contact the local Schneider Electric office for the latest \nsoftware version for ClearSCADA; alternatively, these new versions are \navailable for direct download from the Schneider Electric web site. To \nupdate their license (not required when upgrading to a service pack of \nthe same version), asset owners are required to complete and submit an \nonline form, which is available here:\n\n\n http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update... http://resourcecenter.controlmicrosystems.com/display/CS/StruxureWare+SCADA+Expert+ClearSCADA+Update+Request+Form \n\n\nNew Service packs for ClearSCADA are available for download here:\n\n\n http://resourcecenter.controlmicrosystems.com/display/CS/SCADA+Expert+ClearSCADA+Support \n\n\nGeneral instructions on how to upgrade the ClearSCADA license (if required) are available here:\n\n\n http://resourcecenter.controlmicrosystems.com/display/CS/Updating+Your+ClearSCADA+License"
        }
      ],
      "source": {
        "advisory": "ICSA-14-259-01",
        "discovery": "EXTERNAL"
      },
      "title": "Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-5411",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-259-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-5411",
    "datePublished": "2014-09-18T10:00:00.000Z",
    "dateReserved": "2014-08-22T00:00:00.000Z",
    "dateUpdated": "2025-11-04T22:53:17.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted