Cross-site Scripting Vulnerability in EcoStruxure Building Operation by Schneider Electric
CVE-2020-28210

6.1MEDIUM

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure Building Operation Webstation V2.0 - V3.1
Vendor
CVE Published:
19 November 2020

What is CVE-2020-28210?

A vulnerability exists in EcoStruxure Building Operation WebStation versions 2.0 to 3.1, which allows an attacker to exploit improper input neutralization during web page generation. This flaw can enable the injection of malicious HTML and JavaScript into a user's browser, potentially leading to unauthorized actions or data theft.

Affected Version(s)

EcoStruxure Building Operation WebStation V2.0 - V3.1 EcoStruxure Building Operation WebStation V2.0 - V3.1

References

https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.