Lucene search

EatonCVE-2024-31414

HistorySep 13, 2024 - 5:15 p.m.

CVE-2024-31414

2024-09-1317:15:11

CWE-79

Eaton

web.nvd.nist.gov

eaton foreseer

dashboard customization

input sanitization

script injection

cve-2024-31414

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

Low

EPSS

0.001

Percentile

17.7%

JSON

The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts when abused by bad actors.

Affected configurations

Nvd

Node

eatonforeseer_electrical_power_monitoring_systemRange<7.8.600

VendorProductVersionCPE
eatonforeseer_electrical_power_monitoring_system*cpe:2.3:a:eaton:foreseer_electrical_power_monitoring_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eaton	foreseer_electrical_power_monitoring_system	*	cpe:2.3:a:eaton:foreseer_electrical_power_monitoring_system::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Foreseer",
    "vendor": "Eaton",
    "versions": [
      {
        "lessThan": "7.8.600",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

Low

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-31414