Not rated
CVE-2020-7570 A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability…
Description
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EcoStruxure Building Operation WebReports V1.9 - V3.1 | Versions not published |
Other CVEs of EcoStruxure Building Operation WebReports V1.9 - V3.1
The 5 CVEs of EcoStruxure Building Operation WebReports V1.9 - V3.1 →
CVE-2020-7573
A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that…
Not rated
CVE-2020-7572
A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation…
Not rated
CVE-2020-7571
A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected)…
Not rated
CVE-2020-7569
A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation…
Not rated