PT-2019-9685 · Tridium · Tridium Niagara 4.4+3

Daniel Santos + 1 · Published 2019-01-29 · Updated 2019-10-09 · CVE-2018-18985

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tridium Niagara Enterprise Security versions prior to 2.3.118.6 Tridium Niagara AX versions prior to 3.8.401.1 Tridium Niagara 4.4 versions prior to 4.4.93.40.2 Tridium Niagara 4.6 versions prior to 4.6.96.28.4

Description A cross-site scripting issue has been identified that may allow a remote attacker to inject code into some web pages, affecting confidentiality.

Recommendations For Tridium Niagara Enterprise Security versions prior to 2.3.118.6, update to version 2.3.118.6 or later. For Tridium Niagara AX versions prior to 3.8.401.1, update to version 3.8.401.1 or later. For Tridium Niagara 4.4 versions prior to 4.4.93.40.2, update to version 4.4.93.40.2 or later. For Tridium Niagara 4.6 versions prior to 4.6.96.28.4, update to version 4.6.96.28.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-18985

Affected Products

Tridium Niagara 4.4

Tridium Niagara 4.6

Tridium Niagara Ax

Tridium Niagara Enterprise Security

References · 4

• https://osv.dev/vulnerability/CVE-2018-18985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18985 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-333-02 · Note
• http://securityfocus.com/bid/106530 · Note