Cross site scripting

2021-06-1422:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

22.9%

JSON

Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3 version 5.3.0.1 and prior versions; 5.2 version 5.2.0.3 and prior versions; 5.1 version 5.1.0.6 and prior versions.

CPENameOperatorVersion
ellipse_asset_performance_managementge5.1.0.0
ellipse_asset_performance_managementle5.1.0.6
ellipse_asset_performance_managementge5.2.0.0
ellipse_asset_performance_managementle5.2.0.3
ellipse_asset_performance_managementge5.3.0.0
ellipse_asset_performance_managementle5.3.0.1

Name	Operator	Version
ellipse_asset_performance_management	ge	5.1.0.0
ellipse_asset_performance_management	le	5.1.0.6
ellipse_asset_performance_management	ge	5.2.0.0
ellipse_asset_performance_management	le	5.2.0.3
ellipse_asset_performance_management	ge	5.3.0.0
ellipse_asset_performance_management	le	5.3.0.1