CVE-2017-13994

Опубликовано: 05 окт. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link.

Ссылки

http://www.securityfocus.com/bid/100847
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-257-01
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/100847
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-257-01
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:loytec:lvis-3me_firmware:*:*:*:*:*:*:*:*

Версия до 6.1.1 (включая)

cpe:2.3:h:loytec:lvis-3me:-:*:*:*:*:*:*:*

EPSS

Процентиль: 49%

0.00259

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-c3wc-2r6v-8ccp