CVE-2023-31155: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-2241…
Improper Neutralization of Input During Web Page Generation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The SEL RTAC web interface doesn't properly filter user input, allowing an authenticated attacker to inject malicious scripts that run in other users' browsers. This can be used to steal sensitive information or perform unauthorized actions on behalf of victims.
Cross-site Scripting (XSS) vulnerability in SEL RTAC Web Interface resulting from improper input sanitization during HTML generation. Attack requires prior authentication and allows injection of arbitrary JavaScript code that executes in victim browsers, potentially enabling session hijacking or credential theft.
In the same product, most dangerous first.