CVE-2023-5987

State: Published
Severity: 6.1 Medium
Published: Nov 15, 2023
Updated: Aug 2, 2024
Reserved: Nov 7, 2023

Description

A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	schneider

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
EcoStruxure Power Monitoring Expert (PME)Schneider Electric	Version 2020 CU2 and priorAffected Version 2021 CU1 and priorAffected
EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards ModuleSchneider Electric	Advanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021Affected Advanced Reporting and Dashboards Module 2020 prior to CU3Affected
EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards ModuleSchneider Electric	EcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2Affected

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-318-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-318-02.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.