Cross site scripting

2023-05-1020:15:00

PRIOn knowledge base

www.prio-n.com

cross-site scripting

input neutralization

web page generation

sel rtac

remote authenticated attacker

arbitrary script code

service bulletin

nvd

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.6%

JSON

An Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.

See SEL Service Bulletin dated 2022-11-15 for more details.

CPENameOperatorVersion
sel-2241_rtac_module_firmwareeq>= r132v0 AND < r150v2
sel-3350_firmwareeq>= r148v0 AND < r150v2
sel-3505-3_firmwareeq>= r132v0 AND < r150v2
sel-3505_firmwareeq>= r132v0 AND < r150v2
sel-3530-4_firmwareeq>= r132v0 AND < r150v2
sel-3530_firmwareeq>= r132v0 AND < r150v2
sel-3532_firmwareeq>= r132v0 AND < r150v2
sel-3555_firmwareeq>= r134v0 AND < r150v2
sel-3560e_firmwareeq>= r144v2 AND < r150v2
sel-3560s_firmwareeq>= r144v2 AND < r150v2

Name	Operator	Version
sel-2241_rtac_module_firmware	eq	>= r132v0 AND < r150v2
sel-3350_firmware	eq	>= r148v0 AND < r150v2
sel-3505-3_firmware	eq	>= r132v0 AND < r150v2
sel-3505_firmware	eq	>= r132v0 AND < r150v2
sel-3530-4_firmware	eq	>= r132v0 AND < r150v2
sel-3530_firmware	eq	>= r132v0 AND < r150v2
sel-3532_firmware	eq	>= r132v0 AND < r150v2
sel-3555_firmware	eq	>= r134v0 AND < r150v2
sel-3560e_firmware	eq	>= r144v2 AND < r150v2
sel-3560s_firmware	eq	>= r144v2 AND < r150v2