// For flags

CVE-2023-6028

SDM Web interface vulnerable to XSS

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A reflected
cross-site scripting (XSS) vulnerability exists in the SVG version of System
Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that
enables a remote attacker to execute arbitrary JavaScript code in the context
of the attacked user’s browser session.

Existe una vulnerabilidad de cross-site scripting (XSS) reflejada en la versión SVG de System Diagnostics Manager de B&amp;R Automation Runtime versiones &lt;= G4.93 que permite a un atacante remoto ejecutar código JavaScript arbitrario en el contexto de la sesión del navegador del usuario atacado.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-11-08 CVE Reserved
  • 2024-02-05 CVE Published
  • 2024-02-09 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
  • CAPEC-63: Cross-Site Scripting (XSS)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Br-automation
Search vendor "Br-automation"
Automation Runtime
Search vendor "Br-automation" for product "Automation Runtime"
< i4.93
Search vendor "Br-automation" for product "Automation Runtime" and version " < i4.93"
-
Affected