CVE-2021-27418: falha de média gravidade em GE UR family
GE UR family input validation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.6%
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
GE · UR familyCVEs relacionadas — GE UR family
No mesmo produto, das mais perigosas para as menos.
CVE-2021-27426CRITICALGE UR family insecure default variable initializationEPSS 1.2%CVE-2021-27428CRITICALGE UR family Unrestricted Upload of File with Dangerous TypeEPSS 1.2%CVE-2021-27420MEDIUMGE UR family input validationEPSS 1.0%CVE-2021-27424MEDIUMGE UR family exposure of sensitive information to an unauthorized actorEPSS 0.9%CVE-2021-27422HIGHGE UR family exposure of sensitive information to an unauthorized actorEPSS 0.7%