The Rockwell Automation PowerMonitor 1000 contains stored cross-site scripting vulnerabilities within the web page of the product. The vulnerable pages do not require privileges to access and can be injected with code by an attacker which could be used to leverage an attack on an authenticated user resulting in remote code execution and potentially the complete loss of confidentiality, integrity, and availability of the product.
References
Link | Resource |
---|---|
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139761 | Permissions Required Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
18 Jul 2023, 21:02
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139761 - Permissions Required, Vendor Advisory | |
CWE | CWE-79 | |
CPE | cpe:2.3:o:rockwellautomation:powermonitor_1000_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:rockwellautomation:powermonitor_1000:-:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
11 Jul 2023, 14:27
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-07-11 14:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-2072
Mitre link : CVE-2023-2072
CVE.ORG link : CVE-2023-2072
JSON object : View
Products Affected
rockwellautomation
- powermonitor_1000
- powermonitor_1000_firmware