An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.
Existe una vulnerabilidad de neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) en los servidores web embebidos en todos los productos Modicon M340, Premium, Quantum PLCs y BMXNOR0200, lo que podría permitir que un atacante envíe una URL especialmente manipulada a un usuario autenticado del servidor web para que ejecute un cambio de contraseña en el servidor web.
AV:N/AC:M/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-79
en
CWE-352
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | modicom_m340_firmware | * | <built-in method update of dict object at 0x7e60baa09240> | Operating System |
| schneider-electric | modicom_premium_firmware | * | <built-in method update of dict object at 0x7e60baa08380> | Operating System |
| schneider-electric | modicom_quantum_firmware | * | <built-in method update of dict object at 0x7e60bafae480> | Operating System |
| schneider-electric | modicom_bmxnor0200h_firmware | * | <built-in method update of dict object at 0x7e60bafaf340> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicom_m340_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicom_m340:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicom_premium_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicom_premium:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicom_quantum_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicom_quantum:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicom_bmxnor0200h_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicom_bmxnor0200h:-:*:*:*:*:*:*:* |