A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/105170 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03 | Mitigation Third Party Advisory US Government Resource |
| https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/ | Mitigation Vendor Advisory |
| http://www.securityfocus.com/bid/105170 | Third Party Advisory VDB Entry |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03 | Mitigation Third Party Advisory US Government Resource |
| https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/ | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 04:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/105170 - Third Party Advisory, VDB Entry | |
| References | () https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03 - Mitigation, Third Party Advisory, US Government Resource | |
| References | () https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/ - Mitigation, Vendor Advisory |
Information
Published : 2018-08-29 20:29
Updated : 2024-11-21 04:12
NVD link : CVE-2018-7795
Mitre link : CVE-2018-7795
CVE.ORG link : CVE-2018-7795
JSON object : View
Products Affected
schneider-electric
- powerlogic_pm5560_firmware
- powerlogic_pm5560
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')