Tridium Niagara Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

2020-08-1000:00:00

www.tenable.com

0.001 Low

EPSS

Percentile

23.5%

JSON

Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.

File data ot_500382.nasl

VendorProductVersionCPE
tridiumniagara*cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*
tridiumniagara4.4u2cpe:2.3:a:tridium:niagara:4.4u2:*:*:*:*:*:*:*
tridiumniagara*cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*
tridiumniagara_ax_framework*cpe:2.3:a:tridium:niagara_ax_framework:*:*:*:*:*:*:*:*
tridiumniagara_ax_framework3.8u4cpe:2.3:a:tridium:niagara_ax_framework:3.8u4:*:*:*:*:*:*:*
tridiumniagara_enterprise_security*cpe:2.3:a:tridium:niagara_enterprise_security:*:*:*:*:*:*:*:*
tridiumniagara_enterprise_security2.3u1cpe:2.3:a:tridium:niagara_enterprise_security:2.3u1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tridium	niagara	*	cpe:2.3:a:tridium:niagara::::::::
tridium	niagara	4.4u2	cpe:2.3:a:tridium:niagara:4.4u2:::::::*
tridium	niagara	*	cpe:2.3:a:tridium:niagara::::::::
tridium	niagara_ax_framework	*	cpe:2.3:a:tridium:niagara_ax_framework::::::::
tridium	niagara_ax_framework	3.8u4	cpe:2.3:a:tridium:niagara_ax_framework:3.8u4:::::::*
tridium	niagara_enterprise_security	*	cpe:2.3:a:tridium:niagara_enterprise_security::::::::
tridium	niagara_enterprise_security	2.3u1	cpe:2.3:a:tridium:niagara_enterprise_security:2.3u1:::::::*