CVE-2023-31165mediumCWE-79

CVE-2023-31165: medium-severity vulnerability in Schweitzer Engineering Laboratories SEL-2241…

Improper Neutralization of Input During Web Page Generation

Published · Updated

Follow this CVE+ Monitor SEL-3350+ Monitor SEL-3532

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.4%
In short

A flaw in the Schweitzer Engineering Laboratories RTAC web interface allows an authenticated user to inject malicious script code that runs in other users' browsers, potentially stealing information or performing unwanted actions.

Technical detail

Cross-site Scripting (XSS) vulnerability in SEL RTAC Web Interface due to improper input sanitization during HTML generation. Attack requires authentication and user interaction (victim visiting crafted page). Impact includes session hijacking, credential theft, and unauthorized actions within the application context.

Summary generated and translated by AI from the official description.
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected products
Schweitzer Engineering Laboratories · SEL-2241 RTAC moduleSchweitzer Engineering Laboratories · SEL-3350Schweitzer Engineering Laboratories · SEL-3505Schweitzer Engineering Laboratories · SEL-3505-3Schweitzer Engineering Laboratories · SEL-3530Schweitzer Engineering Laboratories · SEL-3530-4Schweitzer Engineering Laboratories · SEL-3532Schweitzer Engineering Laboratories · SEL-3555Schweitzer Engineering Laboratories · SEL-3560ESchweitzer Engineering Laboratories · SEL-3560S
Related CVEs — Schweitzer Engineering Laboratories SEL-2241…

In the same product, most dangerous first.

CVE-2023-31149CRITICALImproper Input Validation in Web InterfaceEPSS 1.1%CVE-2023-31148CRITICALImproper Input Validation in Web InterfaceEPSS 1.1%CVE-2023-31166MEDIUMImproper Limitation of a Pathname to a Restricted DirectoryEPSS 0.6%CVE-2023-31161MEDIUMImproper Input Validation in Web InterfaceEPSS 0.5%CVE-2023-2310MEDIUMChannel Accessible by Non-EndpointEPSS 0.5%CVE-2023-31162MEDIUMImproper Input Validation in Web InterfaceEPSS 0.5%