PT-2022-3426 · Eaton · Eaton Intelligent Power Manager

Published 2022-05-10 · Updated 2024-11-27 · CVE-2021-23282

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:A/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager (IPM) versions prior to 1.70

Description The issue exists due to insufficient validation of input from certain resources by the IPM software, leading to stored Cross site scripting. An attacker would need access to the local Subnet and an administrator interaction to compromise the system. The vulnerability may allow a remote attacker to conduct a cross-site scripting (XSS) attack.

Recommendations For versions prior to 1.70, upgrade to version 1.70 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPM software to minimize the risk of exploitation. Additionally, ensure that all input from certain resources is properly validated to prevent stored Cross site scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04204

CVE-2021-23282

Affected Products

Eaton Intelligent Power Manager

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-23282 · Security Note
• https://bdu.fstec.ru/vul/2022-04204 · Security Note
• https://t.me/cvenotify/102490 · Telegram Post
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Manager-Vulnerability-Advisory_1001a_V1.0.pdf · Note
• https://twitter.com/transilienceai/status/1861631133051457781 · Twitter Post
• https://twitter.com/CVEnew/status/1860971049569096023 · Twitter Post
• https://twitter.com/transilienceai/status/1861631141381308792 · Twitter Post
• https://eaton.com/us/en-us/digital/brightlayer/brightlayer-data-centers-suite/disaster-avoidance-software.html · Note
• https://twitter.com/oktsec/status/1861011372559024246 · Twitter Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-130-04 · Note