CVE-2014-3110

2014-07-2414:55:07

CWE-79

[email protected]

web.nvd.nist.gov

cve-2014-3110

cross-site scripting

xss

honeywell

falcon xlweb

linux controller

xlwebexe

security vulnerabilities

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.0%

JSON

Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.

Affected configurations

NVD

Node

honeywellfalcon_xlweb_linux_controllerRange≤2.04.01

honeywellfalcon_xlweb_xlwebexeRange≤2.02.11

CPENameOperatorVersion
honeywell:falcon_xlweb_linux_controllerhoneywell falcon xlweb linux controllerle2.04.01
honeywell:falcon_xlweb_xlwebexehoneywell falcon xlweb xlwebexele2.02.11

CPE	Name	Operator	Version
honeywell:falcon_xlweb_linux_controller	honeywell falcon xlweb linux controller	le	2.04.01
honeywell:falcon_xlweb_xlwebexe	honeywell falcon xlweb xlwebexe	le	2.02.11