PT-2020-5822 · Schneider Electric · Ecostruxure Building Operation Webreports
Published
2020-11-10
·
Updated
2022-01-31
·
CVE-2020-7571
CVSS v2.0
5.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
EcoStruxure Building Operation WebReports versions 1.9 through 3.1
Description:
The issue is related to insufficient protection of the web page structure, allowing a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data. This could lead to a Cross-Site Scripting reflected attack against other WebReport users. The vulnerability is associated with improper neutralization of input during web page generation.
Recommendations:
For versions 1.9 through 3.1, update to a version that properly sanitizes user-supplied data to prevent Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the WebReports feature until a patch is available. Additionally, ensure that all user input is validated and sanitized to minimize the risk of exploitation.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ecostruxure Building Operation Webreports