Security readout for executives and security teams
Plain-English summary
EcoStruxure Building Operation WebReports V1.9 through V3.1 has a stored cross-site scripting flaw. An authenticated remote user could save malicious script or HTML that later runs in other WebReport users' browsers. The provided sources do not state a CVSS score, patch version, or active exploitation.
Executive priority
Treat this as a moderate-priority remediation item for affected building operations environments. The issue requires authenticated access, but stored XSS can affect other users and should not remain unresolved in administrative or operational reporting systems.
Technical view
CVE-2020-7570 is CWE-79 stored XSS caused by incorrect sanitization of user-supplied data in EcoStruxure Building Operation WebReports V1.9-V3.1. The described attacker position is authenticated remote user. Impact is execution of arbitrary web script or HTML against other WebReport users.
Likely exposure
Exposure is limited to organizations running EcoStruxure Building Operation WebReports versions V1.9 through V3.1. Risk is higher where WebReports is reachable by many authenticated users or exposed beyond tightly managed administrative networks.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The CVE description supports authenticated remote stored XSS only. It does not support unauthenticated exploitation, privilege level changes, or specific browser/session theft outcomes.
Researcher notes
Evidence is limited to the CVE description and Schneider Electric advisory reference. No CVSS vector, patch details, affected CPEs, exploit status, or technical input locations are provided in the bundle. Validation should focus on version confirmation and vendor advisory mapping.
Mitigation direction
- Review Schneider Electric advisory SEVD-2020-315-04 for vendor remediation guidance.
- Apply vendor-recommended updates or mitigations when confirmed applicable.
- Restrict WebReports access to trusted users and managed networks.
- Disable unnecessary WebReports exposure until remediation is complete.
- Review WebReports user permissions for unnecessary content submission capability.
Validation and detection
- Inventory EcoStruxure Building Operation WebReports deployments and exact versions.
- Confirm whether any deployment is V1.9 through V3.1.
- Check whether WebReports is reachable from untrusted networks.
- Review authenticated user roles with access to WebReports input fields.
- Look for vendor advisory remediation status before closing the finding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-7570 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.se.com/ww/en/download/document/SEVD-2020-315-04/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.