PT-2023-29465 · Real Time Automation · Real Time Automation 460 Series

Published 2023-09-27 · Updated 2023-09-29 · CVE-2023-4523

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Real Time Automation 460 Series products versions prior to 8.9.8

Description The issue allows an attacker to run any JavaScript reference from the URL string, which could lead to a cross-site scripting attack. If this occurs, the gateway's HTTP interface would redirect to the main page, index.htm.

Recommendations For versions prior to 8.9.8, update to version 8.9.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP interface to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-4523

Affected Products

Real Time Automation 460 Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-4523 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4523 · Vendor Advisory
• https://twitter.com/CVEnew/status/1707107039204581379 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1707137357059592483 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-264-01 · Note