PT-2023-7387 · Unknown · Osprey Pump Controller

Published 2023-03-28 · Updated 2023-04-05 · CVE-2023-28648

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Osprey Pump Controller version 1.01

Description The issue exists due to inadequate protection of the web page structure, allowing a remote attacker to execute arbitrary code. Specifically, inputs passed to a GET parameter are not properly sanitized before being returned to the user, which can be exploited to execute arbitrary HTML/JS code in a user's browser session.

Recommendations For Osprey Pump Controller version 1.01, ensure that inputs passed to GET parameters are properly sanitized to prevent exploitation. As a temporary workaround, consider restricting access to the affected site or disabling the execution of HTML/JS code in the user's browser session until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08419

CVE-2023-28648

Affected Products

Osprey Pump Controller

References · 5

• https://osv.dev/vulnerability/CVE-2023-28648 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28648 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-082-06 · Note
• https://t.me/cvenotify/47585 · Telegram Post