5.4
Medium
CVE-2024-8401 CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when…
Description
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EcoStruxure Power Monitoring Expert (PME) 2021 | Versions not published | |
| EcoStruxure Power Monitoring Expert (PME) 2020 | Versions not published | |
| EcoStruxure Power Operation (EPO) 2022 | Versions not published | |
| EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module | Versions not published | |
| EcoStruxure Power Operation (EPO) 2021 | Versions not published | |
| EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module | Versions not published | |
| EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module | Versions not published |