Cross-Site Scripting Vulnerability in EcoStruxure Power Monitoring Expert by Schneider Electric

CVE-2022-22804

Summary

There exists a cross-site scripting (XSS) vulnerability in EcoStruxure Power Monitoring Expert that allows an authenticated attacker to inject malicious scripts. This vulnerability can enable attackers to manipulate web pages and potentially view sensitive data, alter configuration settings, or disrupt the software's availability when users interact with compromised pages containing the malicious payload. The issue primarily affects versions of the product released in 2020 and earlier. It is essential for users to apply necessary updates and security best practices to mitigate the risk of exploitation.

References