PT-2019-9685 · Tridium · Tridium Niagara 4.4+3

Daniel Santos + 1 · Publicado 2019-01-29 · Atualizado 2019-10-09 · CVE-2018-18985

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara Enterprise Security versions prior to 2.3.118.6 Tridium Niagara AX versions prior to 3.8.401.1 Tridium Niagara 4.4 versions prior to 4.4.93.40.2 Tridium Niagara 4.6 versions prior to 4.6.96.28.4

Description A cross-site scripting issue has been identified that may allow a remote attacker to inject code into some web pages, affecting confidentiality.

Recommendations For Tridium Niagara Enterprise Security versions prior to 2.3.118.6, update to version 2.3.118.6 or later. For Tridium Niagara AX versions prior to 3.8.401.1, update to version 3.8.401.1 or later. For Tridium Niagara 4.4 versions prior to 4.4.93.40.2, update to version 4.4.93.40.2 or later. For Tridium Niagara 4.6 versions prior to 4.6.96.28.4, update to version 4.6.96.28.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-18985

Produtos afetados

Tridium Niagara 4.4

Tridium Niagara 4.6

Tridium Niagara Ax

Tridium Niagara Enterprise Security

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-18985 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-333-02 · Nota
• http://securityfocus.com/bid/106530 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18985 · Nota de Segurança