Lucene search

PRIOn knowledge basePRION:CVE-2023-28648

HistoryMar 28, 2023 - 9:15 p.m.

Design/Logic Flaw

2023-03-2821:15:00

PRIOn knowledge base

www.prio-n.com

osprey pump controller

version 1.01

get parameter

input vulnerability

arbitrary code execution

html

browser session

affected site

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.2%

JSON

Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user’s browser session in context of an affected site.

CPENameOperatorVersion
osprey_pump_controller_firmwareeq1.01

CPE	Name	Operator	Version
	osprey_pump_controller_firmware	eq	1.01

References

www.cisa.gov/news-events/ics-advisories/icsa-23-082-06