PT-2024-14857 · B&R · B&R Automation Runtime

Published 2024-02-05 · Updated 2024-02-09 · CVE-2023-6028

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions B&R Automation Runtime versions <= G4.93

Description A reflected cross-site scripting (XSS) vulnerability exists in the SVG version of System Diagnostics Manager that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session.

Recommendations For versions <= G4.93, consider disabling the SVG version of System Diagnostics Manager as a temporary workaround until a patch is available. Restrict access to the System Diagnostics Manager to minimize the risk of exploitation. Avoid using the vulnerable SVG version in the affected browser sessions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6028

Affected Products

B&R Automation Runtime

References · 5

• https://br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6028 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6028 · Vendor Advisory
• https://twitter.com/CVEnew/status/1754563640940798040 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1754588616641139096 · Twitter Post