PT-2015-2606 · Janitza · Janitza Umg

Published 2015-10-28 · Updated 2015-10-28 · CVE-2015-3970

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Janitza UMG versions 508, 509, 511, 604, 605

Description The issue exists due to a lack of protection for the web page structure in the web interface of the Janitza UMG devices. This allows a remote attacker to inject arbitrary web or HTML code, potentially leading to cross-site scripting (XSS) attacks.

Recommendations For Janitza UMG versions 508, 509, 511, 604, 605, consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using the web interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11971

CVE-2015-3970

Affected Products

Janitza Umg

References · 3

• https://bdu.fstec.ru/vul/2015-11971 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-265-03 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-3970 · Security Note