PT-2019-13401 · 3S Smart Software Solutions · Codesys V3 Library Manager

Publicado 2019-09-17 · Atualizado 2021-06-09 · CVE-2019-13538

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager versions prior to 3.5.16.0

Description The issue allows the system to display active library content without checking its validity, potentially enabling the display or execution of manipulated library contents. This also affects source libraries, although it is recommended to distribute compiled libraries only.

Recommendations For versions prior to 3.5.16.0, update to version 3.5.16.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of source libraries and focus on distributing compiled libraries only, as recommended by 3S-Smart Software Solutions GmbH.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-13538

Produtos afetados

Codesys V3 Library Manager

Referências · 4

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12940&token=7723e5ed99830656f487e218e73dce2de751102f · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13538 · Nota de Segurança
• https://us-cert.gov/ics/advisories/icsa-19-255-02 · Nota
• https://osv.dev/vulnerability/CVE-2019-13538 · Aviso do Fabricante