PT-2023-6876 · Schneider Electric · Ecostruxure Power Monitoring Expert+2
Publicado
2023-11-14
·
Atualizado
2023-11-30
·
CVE-2023-5987
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
EcoStruxure PowerSCADA Operation (PSO) - Advanced Reporting and Dashboards Module versions (affected versions not specified)
EcoStruxure PowerOperation (EPO) - Advanced Reporting and Dashboards Module versions (affected versions not specified)
EcoStruxure Power Monitoring Expert versions (affected versions not specified)
Description
The issue is related to the lack of protection of the web page structure, which can be exploited by a remote attacker to execute arbitrary JavaScript code. This can lead to a cross-site scripting condition where attackers can have a victim's browser run arbitrary JavaScript when they visit a page containing the injected payload.
Recommendations
For EcoStruxure PowerSCADA Operation (PSO) - Advanced Reporting and Dashboards Module, consider disabling the execution of JavaScript code in the affected module until a patch is available.
For EcoStruxure PowerOperation (EPO) - Advanced Reporting and Dashboards Module, restrict access to the vulnerable web pages to minimize the risk of exploitation.
For EcoStruxure Power Monitoring Expert, avoid using the affected web pages until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ecostruxure Power Monitoring Expert
Ecostruxure Poweroperation
Ecostruxure Powerscada Operation