PT-2019-14635 · Scadabr · Scadabr

Published 2019-10-14 · Updated 2019-10-17 · CVE-2019-16344

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ScadaBR version 1.0CE

Description A cross-site scripting issue exists in the login form, specifically at the "/ScadaBR/login.htm" endpoint, allowing a remote attacker to inject arbitrary web script or HTML via the username or password parameters.

Recommendations For ScadaBR version 1.0CE, consider disabling the login form at the "/ScadaBR/login.htm" endpoint until a patch is available, or restrict access to this endpoint to minimize the risk of exploitation. Avoid using the username and password parameters in this endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16344

Affected Products

Scadabr

References · 3

• 🔥 https://fabiantronc.wordpress.com/2019/10/11/xss-on-scadabr-1-0ce · Exploit
• https://osv.dev/vulnerability/CVE-2019-16344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16344 · Security Note