5.3
Moyenne
CVE-2021-27418 GE UR firmware versions prior to version 8.1x supports web interface with read-only access
Description
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| UR family 8.1 | premières → < 8.1x | 8.1x |
Autres CVE de UR family
Les 6 CVE de UR family →
CVE-2021-27422
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol
7.5
Élevée
CVE-2021-27426
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the…
9.8
Critique
CVE-2021-27424
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide
5.3
Moyenne
CVE-2021-27428
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool –…
9.8
Critique