Description
A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Schneider Electric Wonderware InTouch Access Anywhere | Schneider Electric Wonderware InTouch Access Anywhere | — |
Advisories 1
- ICSA-17-089-01 Schneider Electric Wonderware InTouch Access Anywhere CISA ICS & IT advisories · Mar 30, 2017