A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.
Una vulnerabilidad CWE-79: Neutralización Inadecuada de la Entrada Durante la Generación de Páginas Web (Cross-site Scripting) que podría causar una vulnerabilidad que conduzca a una condición de Cross-Site Scripting donde los atacantes pueden hacer que el navegador de la víctima ejecute JavaScript arbitrario cuando visitan una página que contiene un payload inyectado.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-79
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | ecostruxure_power_monitoring_expert | 2020 | <built-in method update of dict object at 0x7e6111a184c0> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 2020 | <built-in method update of dict object at 0x7e6111aa2200> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 2020 | <built-in method update of dict object at 0x7e6111aa2c80> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 2021 | <built-in method update of dict object at 0x7e6111aace00> | Application |
| schneider-electric | ecostruxure_power_monitoring_expert | 2021 | <built-in method update of dict object at 0x7e6111aaeec0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:2020:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:2020:cumulative_update_1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:2020:cumulative_update_2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:2021:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:2021:cumulative_update_1:*:*:*:*:*:* |