Description
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Hitachi Energy MACH SCM Server
Default version status: unaffected
4.0 to ≤ 4.38.3affected
Hitachi Energy MACH SCM Tools
Default version status: unaffected
1.0 to ≤ 1.8affected