PT-2019-14635 · Scadabr · Scadabr

Publicado 2019-10-14 · Atualizado 2019-10-17 · CVE-2019-16344

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ScadaBR version 1.0CE

Description A cross-site scripting issue exists in the login form, specifically at the "/ScadaBR/login.htm" endpoint, allowing a remote attacker to inject arbitrary web script or HTML via the username or password parameters.

Recommendations For ScadaBR version 1.0CE, consider disabling the login form at the "/ScadaBR/login.htm" endpoint until a patch is available, or restrict access to this endpoint to minimize the risk of exploitation. Avoid using the username and password parameters in this endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-16344

Produtos afetados

Scadabr

Referências · 3

• 🔥 https://fabiantronc.wordpress.com/2019/10/11/xss-on-scadabr-1-0ce · Exploit
• https://osv.dev/vulnerability/CVE-2019-16344 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16344 · Nota de Segurança