PT-2016-1222 · Sauter · Moduweb Vision

Martin Jartelius · Published 2016-02-06 · Updated 2020-06-24 · CVE-2015-7916

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sauter moduWeb Vision versions prior to 1.6.0

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML via a crafted query. This is due to the lack of protection measures for the web page structure, which can be exploited by a remote attacker to inject malicious code.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the moduWeb Vision interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2016-00483

CVE-2015-7916

Affected Products

Moduweb Vision

References · 4

• https://bdu.fstec.ru/vul/2016-00483 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7916 · Security Note
• http://seclists.org/fulldisclosure/2016/Feb/25 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-033-01 · Note