PT-2020-10154 · Rittal · Rittal Cmc Pu Iii

Published 2020-10-01 · Updated 2020-10-13 · CVE-2019-19393

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rittal CMC PU III versions 3.00 to 3.15.70 4

Description The issue concerns a failure to sanitize user input on the system configurations page of the web application. This allows an attacker to inject HTML and browser-interpreted content, such as JavaScript, which is displayed before and after login. The exploitation of this issue can lead to the modification of displayed content or changes to the victim's information. It requires access to the web management interface, either with valid credentials or through a hijacked session.

Recommendations For versions 3.00 to 3.15.70 4, as a temporary workaround, consider restricting access to the system configurations page to minimize the risk of exploitation. Avoid using the web management interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19393

Affected Products

Rittal Cmc Pu Iii

References · 4

• 🔥 https://github.com/miguelhamal/CVE-2019-19393 · Exploit
• https://osv.dev/vulnerability/CVE-2019-19393 · Vendor Advisory
• https://rittal.us/monitoring-security/cmc-iii.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19393 · Security Note