PT-2019-13401 · 3S Smart Software Solutions · Codesys V3 Library Manager

Published 2019-09-17 · Updated 2021-06-09 · CVE-2019-13538

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager versions prior to 3.5.16.0

Description The issue allows the system to display active library content without checking its validity, potentially enabling the display or execution of manipulated library contents. This also affects source libraries, although it is recommended to distribute compiled libraries only.

Recommendations For versions prior to 3.5.16.0, update to version 3.5.16.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of source libraries and focus on distributing compiled libraries only, as recommended by 3S-Smart Software Solutions GmbH.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13538

Affected Products

Codesys V3 Library Manager

References · 4

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12940&token=7723e5ed99830656f487e218e73dce2de751102f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13538 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13538 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-19-255-02 · Note