CVE-2022-37952

WorkstationST - Reflected XSS in iHistorian Data Display Tags

State: Published
Severity: 4.7 Medium
Published: Aug 25, 2022
Updated: Sep 17, 2024
Reserved: Aug 8, 2022

Description

A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N	GE GP

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
WorkstationSTGE Gas Power	before 07.09.15Affected

References

https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Reflected_XSS.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.