Stored XSS Vulnerability in OpenPLC Runtime Web Interface
CVE-2021-3351

5.4MEDIUM

Key Information:

Vendor

Openplcproject

Status
Openplc
Vendor
CVE Published:
2 August 2021

What is CVE-2021-3351?

The OpenPLC runtime version 3 and earlier, up to March 14, 2016, is vulnerable to stored XSS attacks through the Device Name field on the Add New Device page. This vulnerability can allow attackers to inject malicious scripts, enabling them to manipulate user sessions or steal sensitive information. It is essential for users to validate and sanitize inputs to mitigate this risk.

References

https://www.youtube.com/watch?v=eSAqXq4m8so
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.