PT-2023-29465 · Real Time Automation · Real Time Automation 460 Series

CVE-2023-4523 · Publicado 2023-09-27 · Atualizado 2023-09-29

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Real Time Automation 460 Series products versions prior to 8.9.8

Description The issue allows an attacker to run any JavaScript reference from the URL string, which could lead to a cross-site scripting attack. If this occurs, the gateway's HTTP interface would redirect to the main page, index.htm.

Recommendations For versions prior to 8.9.8, update to version 8.9.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP interface to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-4523

Produtos afetados

Real Time Automation 460 Series

Referências · 5

• https://twitter.com/CVEnew/status/1707107039204581379 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1707137357059592483 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4523 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-23-264-01 · Nota
• https://osv.dev/vulnerability/CVE-2023-4523 · Aviso do Fabricante