{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-18T19:43:02.524","vulnerabilities":[{"cve":{"id":"CVE-2020-7572","sourceIdentifier":"cybersecurity@se.com","published":"2020-11-19T22:15:15.457","lastModified":"2026-06-17T03:25:02.340","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser."},{"lang":"es","value":"Se presenta una vulnerabilidad de Restricción Inapropiada de una Referencia de tipo XML External Entity CWE-611 en EcoStruxure Building Operation WebReports versiones V1.9 - V3.1, que podría causar que un usuario remoto autenticado pueda inyectar código XML arbitrario y obtener una divulgación de datos confidenciales, una denegación de servicio, una falsificación de peticiones del lado del servidor debido a una configuración inapropiada del analizador XML"}],"affected":[{"source":"cybersecurity@se.com","affectedData":[{"vendor":"n/a","product":"EcoStruxure Building Operation WebReports V1.9 - V3.1","versions":[{"version":"EcoStruxure Building Operation WebReports V1.9 - V3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cybersecurity@se.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:schneider-electric:webreports:*:*:*:*:*:*:*:*","versionStartIncluding":"1.9","versionEndIncluding":"3.1","matchCriteriaId":"EFEA3AED-DBEB-4B15-AD56-CEE221637C39"}]}]}],"references":[{"url":"https://www.se.com/ww/en/download/document/SEVD-2020-315-04/","source":"cybersecurity@se.com","tags":["Patch","Product","Vendor Advisory"]},{"url":"https://www.se.com/ww/en/download/document/SEVD-2020-315-04/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Product","Vendor Advisory"]}]}}]}