Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-11023 (GCVE-0-2020-11023)
Vulnerability from cvelistv5 – Published: 2020-04-29 00:00 – Updated: 2025-10-21 23:35Title
Potential XSS vulnerability in jQuery
Summary
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Severity
6.9 (Medium)
SSVC
Exploitation: active
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
67 references
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 8eb55525-535b-41c6-8658-b0826a8afda6
Exploited: Yes
Timestamps
First Seen: 2025-01-23
Asserted: 2025-01-23
Scope
Notes: KEV entry: JQuery Cross-Site Scripting (XSS) Vulnerability | Affected: JQuery / JQuery | Description: JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2025-02-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 ; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2020-11023
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-79 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | JQuery |
| Due Date | 2025-02-13 |
| Date Added | 2025-01-23 |
| Vendorproject | JQuery |
| Vulnerabilityname | JQuery Cross-Site Scripting (XSS) Vulnerability |
| Knownransomwarecampaignuse | Unknown |
References
Created: 2026-02-02 12:26 UTC
| Updated: 2026-02-06 07:17 UTC
KEVIntel
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 4e1198df-371f-4145-b57c-23319f5c7afd
Exploited: Yes
Timestamps
First Seen: 2025-01-23
Asserted: 2025-01-23
Scope
Notes: KEVIntel entry: Potential XSS vulnerability in jQuery | Affected: jquery / jQuery | CVSS: 6.9 (MEDIUM) | Used in malware: unknown | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | Potential XSS vulnerability in jQuery |
| Vendor | jquery |
| Product | jQuery |
| Added Date | 2025-01-23T00:00:00.000Z |
| Cvss Score | 6.9 |
| Epss Score | None |
| Cvss Severity | MEDIUM |
| Epss Percentile | None |
| Used In Malware | unknown |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | False |
References
Created: 2026-06-23 14:06 UTC
| Updated: 2026-06-23 14:06 UTC
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-01-23T21:07:47.681Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37"
},
{
"name": "DSA-4693",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4693"
},
{
"name": "FEDORA-2020-36d2db5f51",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jquery.com/upgrade-guide/3.5/"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200511-0006/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.drupal.org/sa-core-2020-002"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6"
},
{
"tags": [
"x_transferred"
],
"url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released"
},
{
"name": "openSUSE-SU-2020:1060",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"name": "[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "FEDORA-2020-fbb94073a1",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/"
},
{
"name": "FEDORA-2020-0b32a59b54",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/"
},
{
"name": "[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403)",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E"
},
{
"name": "FEDORA-2020-fe94df8c34",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/"
},
{
"name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E"
},
{
"name": "openSUSE-SU-2020:1888",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html"
},
{
"name": "[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023 (#64)",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.5.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html"
},
{
"name": "[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tenable.com/security/tns-2021-02"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-11023",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-23T18:07:17.892570Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-01-23",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T23:35:45.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-23T00:00:00.000Z",
"value": "CVE-2020-11023 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jQuery",
"vendor": "jquery",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.3, \u003c 3.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-31T02:06:42.262Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "DSA-4693",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2020/dsa-4693"
},
{
"name": "FEDORA-2020-36d2db5f51",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"url": "https://jquery.com/upgrade-guide/3.5/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20200511-0006/"
},
{
"url": "https://www.drupal.org/sa-core-2020-002"
},
{
"url": "https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6"
},
{
"url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released"
},
{
"name": "openSUSE-SU-2020:1060",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"
},
{
"name": "GLSA-202007-03",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202007-03"
},
{
"name": "openSUSE-SU-2020:1106",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html"
},
{
"name": "[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "FEDORA-2020-fbb94073a1",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/"
},
{
"name": "FEDORA-2020-0b32a59b54",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/"
},
{
"name": "[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403)",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E"
},
{
"name": "[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E"
},
{
"name": "[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E"
},
{
"name": "FEDORA-2020-fe94df8c34",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/"
},
{
"name": "[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E"
},
{
"name": "openSUSE-SU-2020:1888",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html"
},
{
"name": "[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E"
},
{
"name": "[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023 (#64)",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E"
},
{
"name": "[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.5.0 is vulnerable to CVE-2020-11023",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"name": "[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html"
},
{
"name": "[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E"
},
{
"name": "[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E"
},
{
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"url": "https://www.tenable.com/security/tns-2021-10"
},
{
"url": "https://www.tenable.com/security/tns-2021-02"
},
{
"url": "http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html"
},
{
"url": "https://www.oracle.com//security-alerts/cpujul2021.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"name": "[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
},
{
"name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html"
}
],
"source": {
"advisory": "GHSA-jpcq-cgw6-v4j6",
"discovery": "UNKNOWN"
},
"title": "Potential XSS vulnerability in jQuery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-11023",
"datePublished": "2020-04-29T00:00:00.000Z",
"dateReserved": "2020-03-30T00:00:00.000Z",
"dateUpdated": "2025-10-21T23:35:45.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2020-11023",
"cwes": "[\"CWE-79\"]",
"dateAdded": "2025-01-23",
"dueDate": "2025-02-13",
"knownRansomwareCampaignUse": "Unknown",
"notes": "This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 ; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2020-11023",
"product": "JQuery",
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery\u0027s DOM manipulators can execute untrusted code in the context of the user\u0027s browser.",
"vendorProject": "JQuery",
"vulnerabilityName": "JQuery Cross-Site Scripting (XSS) Vulnerability"
},
"epss": {
"cve": "CVE-2020-11023",
"date": "2026-06-29",
"epss": "0.8383",
"percentile": "0.99655"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.0.3\", \"versionEndExcluding\": \"3.5.0\", \"matchCriteriaId\": \"1888A4D3-5058-41FC-9F3B-E837CFC0505C\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36D96259-24BD-44E2-96D9-78CE1D41F956\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0\", \"versionEndExcluding\": \"7.70\", \"matchCriteriaId\": \"70C672EE-2027-4A29-8C14-3450DEF1462A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.7.0\", \"versionEndExcluding\": \"8.7.14\", \"matchCriteriaId\": \"BBFE42E2-6583-4EBE-B320-B8CF9CA0C3BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.8.0\", \"versionEndExcluding\": \"8.8.6\", \"matchCriteriaId\": \"7BA49DB0-ECC3-4155-B76C-0CA292600DE6\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"20.2\", \"matchCriteriaId\": \"96FC5AC6-88AC-4C4D-8692-7489D6DE8E16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A125E817-F974-4509-872C-B71933F42AD1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.7.0\", \"versionEndIncluding\": \"2.8.0\", \"matchCriteriaId\": \"660DB443-6250-4956-ABD1-C6A522B8DCCA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.4.0\", \"versionEndIncluding\": \"2.10.0\", \"matchCriteriaId\": \"3625D477-1338-46CB-90B1-7291D617DC39\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"B602F9E8-1580-436C-A26D-6E6F8121A583\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"55D98C27-734F-490B-92D5-251805C841B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16.1.0\", \"versionEndIncluding\": \"16.4.0\", \"matchCriteriaId\": \"1A0E3537-CB5A-40BF-B42C-CED9211B8892\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C57FD3A-0CC1-4BA9-879A-8C4A40234162\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"698FB6D0-B26F-4760-9B9B-1C65FBFF2126\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4F1D64BC-17BF-4DAE-B5FC-BC41F9C12DFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1\", \"versionEndIncluding\": \"6.4\", \"matchCriteriaId\": \"324821D1-6A7A-4D46-A1C5-03D688F7A32A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.1\", \"versionEndIncluding\": \"4.3\", \"matchCriteriaId\": \"9264AF8A-3819-40E5-BBCB-3B6C95A0D828\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D52F557F-D0A0-43D3-85F1-F10B6EBFAEDF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"062E4E7C-55BB-46F3-8B61-5A663B565891\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB43DFD4-D058-4001-BD19-488E059F4532\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"086E2E5C-44EB-4C07-B298-C04189533996\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA77B994-3872-4059-854B-0974AA5593D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5682DAEB-3810-4541-833A-568C868BCE0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"01BC9AED-F81D-4344-AD97-EEF19B6EA8C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8198E762-9AD9-452B-B1AF-516E52436B7D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51DB64CA-8953-43BB-AEA9-D0D7E91E9FE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CCE1968-016C-43C1-9EE1-FD9F978B688F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5B5DBF4C-84BB-4537-BD8D-E10C5A4B69F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"52893362-272A-4AED-9167-6613C2E86385\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1F726C6-EA5A-40FF-8809-4F48E4AE6976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CD7C26E3-BB0D-4218-8176-319AEA2925C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD67072F-3CFC-480D-9360-81A05D523318\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"652E762A-BCDD-451E-9DE3-F1555C1E4B16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0A6675A3-684B-4486-A451-C6688F1C821B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.2.5.0\", \"matchCriteriaId\": \"3D4EF35F-B239-4820-936F-0FA51DECA8A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.2.5.0\", \"matchCriteriaId\": \"ABEF6749-518B-4D0F-8EA6-40E9FBE4CE0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.12.41\", \"matchCriteriaId\": \"61B4D874-CCF2-4C78-A823-69A62FA1F6C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A0502309-C0D6-4530-9D92-F10B3B36DE14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16.2\", \"versionEndIncluding\": \"16.2.11\", \"matchCriteriaId\": \"1CB8F81A-D028-4258-9A4F-ADEE25BE95FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"17.12.0\", \"versionEndIncluding\": \"17.12.7\", \"matchCriteriaId\": \"E4AA3854-C9FD-4287-85A0-EE7907D1E1ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"18.8.0\", \"versionEndIncluding\": \"18.8.9\", \"matchCriteriaId\": \"E8CD4002-F310-4BE4-AF7B-4BCCB17DA6FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"19.12.0\", \"versionEndIncluding\": \"19.12.4\", \"matchCriteriaId\": \"69112C56-7747-4E11-A938-85A481529F58\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*\", \"matchCriteriaId\": \"36FC547E-861A-418C-A314-DA09A457B13A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*\", \"matchCriteriaId\": \"DF9FEE51-50E3-41E9-AA0D-272A640F85CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*\", \"matchCriteriaId\": \"E69E905F-2E1A-4462-9082-FF7B10474496\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*\", \"matchCriteriaId\": \"0F9B692C-8986-4F91-9EF4-2BB1E3B5C133\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:*\", \"matchCriteriaId\": \"C5F4C40E-3ABC-4C59-B226-224262DCFF37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"20.12\", \"matchCriteriaId\": \"2FF424F8-E15C-415D-A170-EC6450F35282\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6953CFDB-33C0-4B8E-BBBD-E460A17E8ED3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7737E073-B46E-456E-807C-FBEA43872A33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D551CAB1-4312-44AA-BDA8-A030817E153A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"174A6D2E-E42E-4C92-A194-C6A820CD7EF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C93CC705-1F8C-4870-99E6-14BF264C3811\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F14A818F-AA16-4438-A3E4-E64C9287AC66\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6770B6C3-732E-4E22-BF1C-2D2FD610061C\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F9C8C20-42EB-4AB5-BD97-212DEB070C43\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FFF7106-ED78-49BA-9EC5-B889E3685D53\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E63D8B0F-006E-4801-BF9D-1C001BBFB4F9\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56409CEC-5A1E-4450-AA42-641E459CC2AF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B06F4839-D16A-4A61-9BB5-55B13F41E47F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"108A2215-50FB-4074-94CF-C130FA14566D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32F0B6C0-F930-480D-962B-3F4EFDCC13C7\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"803BC414-B250-4E3A-A478-A3881340D6B8\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0FEB3337-BFDE-462A-908B-176F92053CEC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"736AEAE9-782B-4F71-9893-DED53367E102\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0B4AD8A-F172-4558-AEC6-FF424BA2D912\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8497A4C9-8474-4A62-8331-3FE862ED4098\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CDDF61B7-EC5C-467C-B710-B89F502CD04F\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD1FCB0D-3E19-4461-9330-4D7F02972A35\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndIncluding\": \"3.1.3\", \"matchCriteriaId\": \"B9273745-6408-4CD3-94E8-9385D4F5FE69\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F4754FB-E3EB-454A-AB1A-AE3835C5350C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E788440A-02B0-45F5-AFBC-7109F3177033\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.0.9\", \"matchCriteriaId\": \"4ACF85D6-6B45-43DA-9C01-F0208186F014\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\"}, {\"lang\": \"es\", \"value\": \"En jQuery versiones mayores o iguales a 1.0.3 y anteriores a la versi\\u00f3n 3.5.0, passing HTML contiene elementos de fuentes no seguras \\u2013 incluso despu\\u00e9s de sanearlo \\u2013 para uno de los m\\u00e9todos de manipulaci\\u00f3n de jQuery \\u00b4s DOM ( i.e. html t(), adjunto (), y otros ) podr\\u00edan ejecutar c\\u00f3digos no seguros. Este problema est\\u00e1 corregido en JQuery 3.5.0.\"}]",
"id": "CVE-2020-11023",
"lastModified": "2024-11-21T04:56:36.443",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 4.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2020-04-29T21:15:11.743",
"references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Broken Link\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://jquery.com/upgrade-guide/3.5/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://security.gentoo.org/glsa/202007-03\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200511-0006/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4693\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.drupal.org/sa-core-2020-002\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2020.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2022.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2020.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-02\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://jquery.com/upgrade-guide/3.5/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202007-03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200511-0006/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4693\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.drupal.org/sa-core-2020-002\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-11023\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2020-04-29T21:15:11.743\",\"lastModified\":\"2025-11-07T19:32:52.023\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\"},{\"lang\":\"es\",\"value\":\"En jQuery versiones mayores o iguales a 1.0.3 y anteriores a la versi\u00f3n 3.5.0, passing HTML contiene elementos de fuentes no seguras \u2013 incluso despu\u00e9s de sanearlo \u2013 para uno de los m\u00e9todos de manipulaci\u00f3n de jQuery \u00b4s DOM ( i.e. html t(), adjunto (), y otros ) podr\u00edan ejecutar c\u00f3digos no seguros. Este problema est\u00e1 corregido en JQuery 3.5.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"cisaExploitAdd\":\"2025-01-23\",\"cisaActionDue\":\"2025-02-13\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"JQuery Cross-Site Scripting (XSS) Vulnerability\",\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.3\",\"versionEndExcluding\":\"3.5.0\",\"matchCriteriaId\":\"1888A4D3-5058-41FC-9F3B-E837CFC0505C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.70\",\"matchCriteriaId\":\"70C672EE-2027-4A29-8C14-3450DEF1462A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.7.0\",\"versionEndExcluding\":\"8.7.14\",\"matchCriteriaId\":\"BBFE42E2-6583-4EBE-B320-B8CF9CA0C3BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.8.0\",\"versionEndExcluding\":\"8.8.6\",\"matchCriteriaId\":\"7BA49DB0-ECC3-4155-B76C-0CA292600DE6\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"20.2\",\"matchCriteriaId\":\"96FC5AC6-88AC-4C4D-8692-7489D6DE8E16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A125E817-F974-4509-872C-B71933F42AD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.7.0\",\"versionEndIncluding\":\"2.8.0\",\"matchCriteriaId\":\"660DB443-6250-4956-ABD1-C6A522B8DCCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.4.0\",\"versionEndIncluding\":\"2.10.0\",\"matchCriteriaId\":\"3625D477-1338-46CB-90B1-7291D617DC39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"21.1.2\",\"matchCriteriaId\":\"D0DBC938-A782-433F-8BF1-CA250C332AA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:blockchain_platform:21.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2ECE8F5F-4417-4412-B857-F1ACDEED4FC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"B602F9E8-1580-436C-A26D-6E6F8121A583\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55D98C27-734F-490B-92D5-251805C841B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.4.0\",\"matchCriteriaId\":\"1A0E3537-CB5A-40BF-B42C-CED9211B8892\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C57FD3A-0CC1-4BA9-879A-8C4A40234162\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"698FB6D0-B26F-4760-9B9B-1C65FBFF2126\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F1D64BC-17BF-4DAE-B5FC-BC41F9C12DFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndIncluding\":\"6.4\",\"matchCriteriaId\":\"324821D1-6A7A-4D46-A1C5-03D688F7A32A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1\",\"versionEndIncluding\":\"4.3\",\"matchCriteriaId\":\"9264AF8A-3819-40E5-BBCB-3B6C95A0D828\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D52F557F-D0A0-43D3-85F1-F10B6EBFAEDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"062E4E7C-55BB-46F3-8B61-5A663B565891\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB43DFD4-D058-4001-BD19-488E059F4532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"086E2E5C-44EB-4C07-B298-C04189533996\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA77B994-3872-4059-854B-0974AA5593D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5682DAEB-3810-4541-833A-568C868BCE0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01BC9AED-F81D-4344-AD97-EEF19B6EA8C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8198E762-9AD9-452B-B1AF-516E52436B7D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51DB64CA-8953-43BB-AEA9-D0D7E91E9FE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CCE1968-016C-43C1-9EE1-FD9F978B688F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B5DBF4C-84BB-4537-BD8D-E10C5A4B69F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"52893362-272A-4AED-9167-6613C2E86385\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1F726C6-EA5A-40FF-8809-4F48E4AE6976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD7C26E3-BB0D-4218-8176-319AEA2925C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD67072F-3CFC-480D-9360-81A05D523318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"652E762A-BCDD-451E-9DE3-F1555C1E4B16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A6675A3-684B-4486-A451-C6688F1C821B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.2.5.0\",\"matchCriteriaId\":\"3D4EF35F-B239-4820-936F-0FA51DECA8A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.2.5.0\",\"matchCriteriaId\":\"ABEF6749-518B-4D0F-8EA6-40E9FBE4CE0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.12.41\",\"matchCriteriaId\":\"61B4D874-CCF2-4C78-A823-69A62FA1F6C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0502309-C0D6-4530-9D92-F10B3B36DE14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.2\",\"versionEndIncluding\":\"16.2.11\",\"matchCriteriaId\":\"1CB8F81A-D028-4258-9A4F-ADEE25BE95FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.12.0\",\"versionEndIncluding\":\"17.12.7\",\"matchCriteriaId\":\"E4AA3854-C9FD-4287-85A0-EE7907D1E1ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"18.8.0\",\"versionEndIncluding\":\"18.8.9\",\"matchCriteriaId\":\"E8CD4002-F310-4BE4-AF7B-4BCCB17DA6FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"19.12.0\",\"versionEndIncluding\":\"19.12.4\",\"matchCriteriaId\":\"69112C56-7747-4E11-A938-85A481529F58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"36FC547E-861A-418C-A314-DA09A457B13A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"DF9FEE51-50E3-41E9-AA0D-272A640F85CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"E69E905F-2E1A-4462-9082-FF7B10474496\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"0F9B692C-8986-4F91-9EF4-2BB1E3B5C133\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"C5F4C40E-3ABC-4C59-B226-224262DCFF37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"20.12\",\"matchCriteriaId\":\"2FF424F8-E15C-415D-A170-EC6450F35282\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6953CFDB-33C0-4B8E-BBBD-E460A17E8ED3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7737E073-B46E-456E-807C-FBEA43872A33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D551CAB1-4312-44AA-BDA8-A030817E153A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"174A6D2E-E42E-4C92-A194-C6A820CD7EF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C93CC705-1F8C-4870-99E6-14BF264C3811\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F14A818F-AA16-4438-A3E4-E64C9287AC66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6770B6C3-732E-4E22-BF1C-2D2FD610061C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F9C8C20-42EB-4AB5-BD97-212DEB070C43\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FFF7106-ED78-49BA-9EC5-B889E3685D53\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E63D8B0F-006E-4801-BF9D-1C001BBFB4F9\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56409CEC-5A1E-4450-AA42-641E459CC2AF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B06F4839-D16A-4A61-9BB5-55B13F41E47F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"108A2215-50FB-4074-94CF-C130FA14566D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32F0B6C0-F930-480D-962B-3F4EFDCC13C7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"803BC414-B250-4E3A-A478-A3881340D6B8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FEB3337-BFDE-462A-908B-176F92053CEC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"736AEAE9-782B-4F71-9893-DED53367E102\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0B4AD8A-F172-4558-AEC6-FF424BA2D912\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8497A4C9-8474-4A62-8331-3FE862ED4098\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDDF61B7-EC5C-467C-B710-B89F502CD04F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*\",\"matchCriteriaId\":\"F3E0B672-3E06-4422-B2A4-0BD073AEC2A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*\",\"matchCriteriaId\":\"E8F29E19-3A64-4426-A2AA-F169440267CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\",\"matchCriteriaId\":\"B55E8D50-99B4-47EC-86F9-699B67D473CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B199052-5732-4726-B06B-A12C70DFB891\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C93821CF-3117-4763-8163-DD49F6D2CA8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD1FCB0D-3E19-4461-9330-4D7F02972A35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndIncluding\":\"3.1.3\",\"matchCriteriaId\":\"B9273745-6408-4CD3-94E8-9385D4F5FE69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F4754FB-E3EB-454A-AB1A-AE3835C5350C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E788440A-02B0-45F5-AFBC-7109F3177033\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.9\",\"matchCriteriaId\":\"4ACF85D6-6B45-43DA-9C01-F0208186F014\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://jquery.com/upgrade-guide/3.5/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202007-03\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200511-0006/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4693\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/sa-core-2020-002\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-02\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://jquery.com/upgrade-guide/3.5/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202007-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200511-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4693\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/sa-core-2020-002\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/github/advisory-database/blob/99afa6fdeaf5d1d23e1021ff915a5e5dbc82c1f1/advisories/github-reviewed/2020/04/GHSA-jpcq-cgw6-v4j6/GHSA-jpcq-cgw6-v4j6.json#L20-L37\"}, {\"url\": \"https://www.debian.org/security/2020/dsa-4693\", \"name\": \"DSA-4693\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\", \"name\": \"FEDORA-2020-36d2db5f51\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2020.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jquery.com/upgrade-guide/3.5/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200511-0006/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.drupal.org/sa-core-2020-002\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\", \"name\": \"openSUSE-SU-2020:1060\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://security.gentoo.org/glsa/202007-03\", \"name\": \"GLSA-202007-03\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\", \"name\": \"openSUSE-SU-2020:1106\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E\", \"name\": \"[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\", \"name\": \"FEDORA-2020-fbb94073a1\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\", \"name\": \"FEDORA-2020-0b32a59b54\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E\", \"name\": \"[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403)\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\", \"name\": \"FEDORA-2020-fe94df8c34\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E\", \"name\": \"[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2020.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\", \"name\": \"[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\", \"name\": \"openSUSE-SU-2020:1888\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E\", \"name\": \"[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023 (#64)\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.5.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\", \"name\": \"[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-02\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2022.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"name\": \"[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update\", \"tags\": [\"mailing-list\", \"x_transferred\"]}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-01-23T21:07:47.681Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2020-11023\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-23T18:07:17.892570Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-01-23\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-01-23T00:00:00.000Z\", \"value\": \"CVE-2020-11023 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11023\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-23T18:07:28.808Z\"}}], \"cna\": {\"title\": \"Potential XSS vulnerability in jQuery\", \"source\": {\"advisory\": \"GHSA-jpcq-cgw6-v4j6\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"jquery\", \"product\": \"jQuery\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.0.3, \u003c 3.5.0\"}]}], \"references\": [{\"url\": \"https://www.debian.org/security/2020/dsa-4693\", \"name\": \"DSA-4693\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\", \"name\": \"FEDORA-2020-36d2db5f51\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2020.html\"}, {\"url\": \"https://jquery.com/upgrade-guide/3.5/\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200511-0006/\"}, {\"url\": \"https://www.drupal.org/sa-core-2020-002\"}, {\"url\": \"https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6\"}, {\"url\": \"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\", \"name\": \"openSUSE-SU-2020:1060\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202007-03\", \"name\": \"GLSA-202007-03\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\", \"name\": \"openSUSE-SU-2020:1106\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200813 [jira] [Assigned] (HIVE-24039) update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E\", \"name\": \"[hive-dev] 20200813 [jira] [Created] (HIVE-24039) update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200813 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200813 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Work started] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Commented] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200902 [jira] [Comment Edited] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200904 [jira] [Assigned] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200911 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh closed pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200912 [GitHub] [hive] rajkrrsingh opened a new pull request #1403: Hive 24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\", \"name\": \"FEDORA-2020-fbb94073a1\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\", \"name\": \"FEDORA-2020-0b32a59b54\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200915 [jira] [Resolved] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E\", \"name\": \"[hive-commits] 20200915 [hive] branch master updated: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023 (#1403)\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200915 [jira] [Work logged] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E\", \"name\": \"[hive-gitbox] 20200915 [GitHub] [hive] kgyrtkirk merged pull request #1403: HIVE-24039 : Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E\", \"name\": \"[hive-issues] 20200915 [jira] [Updated] (HIVE-24039) Update jquery version to mitigate CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\", \"name\": \"FEDORA-2020-fe94df8c34\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E\", \"name\": \"[nifi-commits] 20200930 svn commit: r1882168 - /nifi/site/trunk/security.html\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2020.html\"}, {\"url\": \"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\", \"name\": \"[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\", \"name\": \"openSUSE-SU-2020:1888\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Created] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [GitHub] [felix-dev] cziegeler merged pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [GitHub] [felix-dev] abhishekgarg18 opened a new pull request #64: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Commented] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Assigned] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E\", \"name\": \"[felix-commits] 20201208 [felix-dev] branch master updated: FELIX-6366 1.0.3 \u003c jQuery \u003c3.4.0 is vulnerable to CVE-2020-11023 (#64)\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E\", \"name\": \"[felix-dev] 20201208 [jira] [Updated] (FELIX-6366) 1.0.3 \u003c jQuery \u003c3.5.0 is vulnerable to CVE-2020-11023\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\"}, {\"url\": \"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\", \"name\": \"[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\"}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\"}, {\"url\": \"https://www.tenable.com/security/tns-2021-02\"}, {\"url\": \"http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html\"}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\"}, {\"url\": \"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\", \"name\": \"[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler\", \"tags\": [\"mailing-list\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2022.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"name\": \"[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update\", \"tags\": [\"mailing-list\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-08-31T02:06:42.262Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2020-11023\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:35:45.230Z\", \"dateReserved\": \"2020-03-30T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2020-04-29T00:00:00.000Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
ICSA-21-306-01
Vulnerability from csaf_cisa - Published: 2021-11-02 00:00 - Updated: 2021-11-02 00:00Summary
Sensormatic Electronics VideoEdge
Notes
CISA Disclaimer: This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation: Successful exploitation of this vulnerability could allow the execution of untrusted code when viewing the VideoEdge admin graphical user interface.
Critical infrastructure sectors: Critical Manufacturing
Countries/areas deployed: Worldwide
Company headquarters location: Ireland
Recommended Practices: CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Exploitability: No known public exploits specifically target this vulnerability.
6.1 (Medium)
References
7 references
Acknowledgments
Johnson Controls, Inc
{
"document": {
"acknowledgments": [
{
"organization": "Johnson Controls, Inc",
"summary": "reporting this vulnerability to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of this vulnerability could allow the execution of untrusted code when viewing the VideoEdge admin graphical user interface.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Critical Manufacturing",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Ireland",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "No known public exploits specifically target this vulnerability.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-306-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-306-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-306-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-306-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Sensormatic Electronics VideoEdge",
"tracking": {
"current_release_date": "2021-11-02T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-306-01",
"initial_release_date": "2021-11-02T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-11-02T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-306-01 Sensormatic Electronics VideoEdge"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 5.7.1",
"product": {
"name": "VideoEdge: All versions prior to v5.7.1",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "VideoEdge"
}
],
"category": "vendor",
"name": "Sensormatic Electronics, LLC, Johnson Controls Inc."
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A vulnerability in the JQuery web user interface (UI) component could allow a webpage to be altered before it is served to users.CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11023"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade VideoEdge: to Version 5.7.1",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "For more detailed mitigation and product upgrade instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2021-17 v1",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2021/jci-psa-2021-17.pdf"
},
{
"category": "mitigation",
"details": "Further ICS security notices and product security guidance are located at the Johnson Controls product security website.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Users with additional questions may contact Johnson Controls Global Product Security.",
"product_ids": [
"CSAFPID-0001"
],
"url": "mailto:productsecurity@jci.com"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001"
]
}
]
}
]
}
ICSA-22-097-01
Vulnerability from csaf_cisa - Published: 2022-04-07 00:00 - Updated: 2022-04-07 00:00Summary
Pepperl+Fuchs WirelessHART-Gateway
Notes
CISA Disclaimer: This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation: Successful exploitation of these vulnerabilities may result in a denial-of-service condition, code execution, and code exposure.
Critical infrastructure sectors: Multiple
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take the following measures to protect themselves from social engineering attacks:
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
Exploitability: No known public exploits specifically target these vulnerabilities.
9.8 (Critical)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
6.1 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
5.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
5.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
5.4 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
5.4 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
5.3 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
4.7 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
CWE-1004
- Sensitive Cookie Without 'HttpOnly' Flag
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
CWE-20
- Improper Input Validation
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
|
|
WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9
Pepperl+Fuchs / WHA-GW-F2D2-0-AS- Z2-ETH.EIP
|
3.0.7 | 3.0.8 | 3.0.9 |
Mitigation
Mitigation
Mitigation
Mitigation
fix
|
References
35 references
Acknowledgments
CERT@VDE
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordinating these vulnerabilities with Pepperl+Fuchs"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities may result in a denial-of-service condition, code execution, and code exposure.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take the following measures to protect themselves from social engineering attacks:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-22-097-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-097-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-22-097-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-097-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Pepperl+Fuchs WirelessHART-Gateway",
"tracking": {
"current_release_date": "2022-04-07T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-22-097-01",
"initial_release_date": "2022-04-07T00:00:00.000000Z",
"revision_history": [
{
"date": "2022-04-07T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-22-097-01 Pepperl+Fuchs WirelessHART-Gateway"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "3.0.7 | 3.0.8 | 3.0.9",
"product": {
"name": "WHA-GW-F2D2-0-AS- Z2-ETH: Versions 3.0.7 3.0.8 3.0.9",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "WHA-GW-F2D2-0-AS- Z2-ETH"
},
{
"branches": [
{
"category": "product_version",
"name": "3.0.7 | 3.0.8 | 3.0.9",
"product": {
"name": "WHA-GW-F2D2-0-AS- Z2-ETH.EIP: Versions 3.0.7 3.0.8 3.0.9",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "WHA-GW-F2D2-0-AS- Z2-ETH.EIP"
}
],
"category": "vendor",
"name": "Pepperl+Fuchs"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-34565",
"cwe": {
"id": "CWE-798",
"name": "Use of Hard-coded Credentials"
},
"notes": [
{
"category": "summary",
"text": "The affected product allows active SSH and telnet services with hard-coded credentials.CVE-2021-34565 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34565"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2016-10707",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "summary",
"text": "jQuery 3.0.0-rc.1 is vulnerable to a denial-of-service condition due to removing a logic a lowercased attribute names. Any attribute using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.CVE-2016-10707 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10707"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-34561",
"cwe": {
"id": "CWE-350",
"name": "Reliance on Reverse DNS Resolution for a Security-Critical Action"
},
"notes": [
{
"category": "summary",
"text": "If the application is not externally accessible or uses IP-based access restrictions, attackers can use DNS rebinding to bypass any IP or firewall-based access restrictions by proxying through their target\u0027s browser. This vulnerability only affects Versions 3.0.7 through 3.0.8.CVE-2021-34561 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34561"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-33555",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability only affects Version 3.0.7.CVE-2021-33555 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33555"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2014-6071",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery Version 1.4.2 allows remote attackers to conduct cross-site scripting attacks via vectors related to use of the text method.CVE-2014-6071 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6071"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2012-6708",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery versions prior to 1.9.0 are vulnerable to cross-site scripting attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the \u0027\u003c\u0027 character anywhere in the string, giving attackers more flexibility when attempting to deliver a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the \u0027\u003c\u0027 character, limiting exploitability only to attackers who can control the beginning of a string.CVE-2012-6708 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6708"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2015-9251",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery versions prior to 3.0.0 are vulnerable to cross-site scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.CVE-2015-9251 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-9251"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In jQuery versions between 1.0.3 and 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources (even after sanitizing it) to one of jQuery\u0027s DOM manipulation methods (i.e., .html(), .append(), and others) may execute untrusted code. This vulnerability is patched in jQuery 3.5.0.CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11023"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2020-11022",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In jQuery versions between 1.2 and 3.5.0, passing HTML from untrusted sources (even after sanitizing it) to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This vulnerability is patched in jQuery 3.5.0.CVE-2020-11022 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11022"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2019-11358",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery versions prior to 3.4.0, as used in specific products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.CVE-2019-11358 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-11358"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2020-7656",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery versions prior to 1.9.0 allow cross-site scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.CVE-2020-7656 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-7656"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-34560",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "The affected product contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user\u0027s computer.CVE-2021-34560 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34560"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-34564",
"cwe": {
"id": "CWE-315",
"name": "Cleartext Storage of Sensitive Information in a Cookie"
},
"notes": [
{
"category": "summary",
"text": "Cookie stealing vulnerabilities within the application or browser allow an attacker to steal the user\u0027s credentials in Version 3.0.9.CVE-2021-34564 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34564"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-34559",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In the affected product, Versions 3.0.7 through 3.0.8 have a vulnerability that may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.CVE-2021-34559 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34559"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-34562",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In the affected product, Version 3.0.8, it is possible to inject arbitrary JavaScript into the application\u0027s response.CVE-2021-34562 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34562"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2007-2379",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "The jQuery framework exchanges data using JavaScript object notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\"CVE-2007-2379 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2379"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2011-4969",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "jQuery versions prior to 1.6.3 contain a Cross-site scripting (XSS) vulnerability, which when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.CVE-2011-4969 has been assigned to this vulnerability. A CVSS v3 base score of 4.7 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4969"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2021-34563",
"cwe": {
"id": "CWE-1004",
"name": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag"
},
"notes": [
{
"category": "summary",
"text": "In the affected product, Versions 3.0.8 and 3.0.9, the HttpOnly attribute is not set on a cookie, which allows the cookie\u0027s value to be read or set by client-side JavaScript.CVE-2021-34563 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34563"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
},
{
"cve": "CVE-2013-0169",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the Lucky Thirteen issue.CVE-2013-0169 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0169"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Minimize network exposure for affected products and ensure they are not accessible via the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "Isolate affected products from the corporate network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "If remote access is required, use secure methods such as virtual private networks (VPNs).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "See CERT@VDE\u0027s advisory VDE-2021-027 for more information",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-027/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
]
}
]
}
ICSA-25-203-05
Vulnerability from csaf_cisa - Published: 2025-07-08 04:00 - Updated: 2025-07-08 04:00Summary
Schneider Electric System Monitor Application
Notes
General Security Recommendations: We strongly recommend the following industry cybersecurity best practices.
https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
For More Information: This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
LEGAL DISCLAIMER: THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
About Schneider Electric: Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.
Our mission is to be the trusted partner in Sustainability and Efficiency.
We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.
We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.
Overview: Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and
Pro-face PS5000 trusted Legacy industrial PC series products.
The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which
incorporate slim, flexible and durable design allowing each customer to configure their iPC based on their
individual application needs. These products offer flexible connectivity to a range of devices and designs.
Failure to apply the remediations provided below may risk untrusted code execution which could result in
operational failures.
Vulnerability Details: Vulnerability disclosed by GitHub in the jQuery product impacts Schneider Electric HMI products.
Additional information about the vulnerability can be found in CVE.org portal:
jQuery CVE Record: CVE-2020-11023 https://www.cve.org/CVERecord?id=CVE-2020-11023
Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp if you need assistance removing a patch.
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer: This ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2025-189-02 from a direct conversion of their vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.
Critical infrastructure sectors: Commercial Facilities, Critical Manufacturing, Energy
Countries/areas deployed: Worldwide
Company headquarters location: France
Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.
Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
6.9 (Medium)
References
12 references
Acknowledgments
Schneider Electric CPCERT
{
"document": {
"acknowledgments": [
{
"organization": "Schneider Electric CPCERT",
"summary": "reporting this vulnerability to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
"title": "General Security Recommendations"
},
{
"category": "general",
"text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
"title": "For More Information"
},
{
"category": "legal_disclaimer",
"text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
"title": "LEGAL DISCLAIMER"
},
{
"category": "general",
"text": "Schneider\u0027s purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and\r\nsustainability for all. We call this Life Is On.\n\nOur mission is to be the trusted partner in Sustainability and Efficiency.\n\nWe are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart\r\nindustries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep\r\ndomain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,\r\nsoftware and services, delivering digital twins to enable profitable growth for our customers.\n\nWe are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries\r\nto ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our\r\nmeaningful purpose of a sustainable future for all.",
"title": "About Schneider Electric"
},
{
"category": "summary",
"text": "Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and \r\nPro-face PS5000 trusted Legacy industrial PC series products.\r\nThe Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which \r\nincorporate slim, flexible and durable design allowing each customer to configure their iPC based on their \r\nindividual application needs. These products offer flexible connectivity to a range of devices and designs. \r\nFailure to apply the remediations provided below may risk untrusted code execution which could result in \r\noperational failures.",
"title": "Overview"
},
{
"category": "general",
"text": "Vulnerability disclosed by GitHub in the jQuery product impacts Schneider Electric HMI products.\r\nAdditional information about the vulnerability can be found in CVE.org portal:\r\njQuery CVE Record: CVE-2020-11023 https://www.cve.org/CVERecord?id=CVE-2020-11023",
"title": "Vulnerability Details"
},
{
"category": "other",
"text": "Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric\u2019s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp if you need assistance removing a patch. "
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2025-189-02 from a direct conversion of their vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Commercial Facilities, Critical Manufacturing, Energy",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "France",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2025-189-02 CSAF Version",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2025-189-02.json"
},
{
"category": "self",
"summary": "System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2025-189-02 PDF Version",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2025-189-02.pdf"
},
{
"category": "external",
"summary": "Recommended Cybersecurity Best Practices",
"url": "https://www.se.com/us/en/download/document/7EN52-0390/"
},
{
"category": "external",
"summary": "GitHub Advisory",
"url": "https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-25-203-05 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-203-05.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-25-203-05 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-05"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Schneider Electric System Monitor Application",
"tracking": {
"current_release_date": "2025-07-08T04:00:00.000000Z",
"generator": {
"date": "2025-07-22T14:29:50.265376Z",
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-25-203-05",
"initial_release_date": "2025-07-08T04:00:00.000000Z",
"revision_history": [
{
"date": "2025-07-08T04:00:00.000000Z",
"number": "1.0.0",
"summary": "Original Release"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "System Monitor application",
"product": {
"name": "Schneider Electric System Monitor application",
"product_id": "CSAFPID-0001"
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Schneider Electric Harmony Industrial PC All Versions",
"product_id": "CSAFPID-0002",
"product_identification_helper": {
"model_numbers": [
"HMIBMO",
"HMIBMI",
"HMIPSO",
"HMIBMP",
"HMIBMU",
"HMIPSP",
"HMIPEP"
]
}
}
}
],
"category": "product_name",
"name": "Harmony Industrial PC"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Schneider Electric Pro-face Industrial PC All Versions",
"product_id": "CSAFPID-0003",
"product_identification_helper": {
"model_numbers": [
"PS5000"
]
}
}
}
],
"category": "product_name",
"name": "Pro-face Industrial PC"
}
],
"category": "vendor",
"name": "Schneider Electric"
}
],
"relationships": [
{
"category": "installed_on",
"full_product_name": {
"name": "Schneider Electric System Monitor application installed on Schneider Electric Harmony Industrial PC All Versions",
"product_id": "CSAFPID-0004"
},
"product_reference": "CSAFPID-0001",
"relates_to_product_reference": "CSAFPID-0002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Schneider Electric System Monitor application installed on Schneider Electric Pro-face Industrial PC All Versions",
"product_id": "CSAFPID-0005"
},
"product_reference": "CSAFPID-0001",
"relates_to_product_reference": "CSAFPID-0003"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "description",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE Description"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0005"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Customer can uninstall System Monitor application using installer \r\navailable for download here:\r\nhttps://www.se.com/ww/en/product-range/61054-\r\nharmony-industrial-pc/#software-and-firmware \r\nPlease follow the steps described in the guideline attached as a .pdf \r\nin the downloaded uninstaller guide.",
"product_ids": [
"CSAFPID-0004"
],
"restart_required": {
"category": "none"
},
"url": "https://www.se.com/ww/en/product-range/61054-harmony-industrial-pc/#software-and-firmware"
},
{
"category": "vendor_fix",
"details": "Customer can uninstall System Monitor application using installer \r\navailable for download here:\r\nhttps://www.proface.com/en/product/ipc/ps5000/download \r\nPlease follow the steps described in the guideline attached as a .pdf \r\nin the downloaded uninstaller guide.",
"product_ids": [
"CSAFPID-0005"
],
"restart_required": {
"category": "none"
},
"url": "https://www.proface.com/en/product/ipc/ps5000/download"
},
{
"category": "mitigation",
"details": "If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations \r\nto reduce the risk of exploit: \r\n\u2022 Stop the system monitor if not required by turning off the services as specified in user guide: \r\no Harmony Industrial PC Series User Manual \r\n\u2022 Setup network segmentation and implement a firewall to block all unauthorized access \r\nto configured HTTP/HTTPS ports.",
"product_ids": [
"CSAFPID-0004"
],
"restart_required": {
"category": "none"
},
"url": "https://www.se.com/ww/en/download/document/EIO0000002042/"
},
{
"category": "mitigation",
"details": "If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations \r\nto reduce the risk of exploit: \r\n\u2022 Stop the system monitor if not required by turning off the services as specified in user guide: \r\no Pro-face PS5000 legacy industrial PC Series User Manual \r\n\u2022 Setup network segmentation and implement a firewall to block all unauthorized access \r\nto configured HTTP/HTTPS ports.",
"product_ids": [
"CSAFPID-0005"
],
"restart_required": {
"category": "none"
},
"url": "https://www.proface.com/en/node/39458"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0004",
"CSAFPID-0005"
]
}
],
"title": "CVE-2020-11023"
}
]
}
ICSA-26-076-01
Vulnerability from csaf_cisa - Published: 2026-02-26 08:00 - Updated: 2026-03-17 06:00Summary
CODESYS in Festo Automation Suite
Severity
Critical
Notes
Summary: Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.
This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.
Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.
Impact: The vulnerabilities covered by this advisory have a broad range of impacts ranging from denial-of-service to disclosure or manipulation/deletion of information.
Remediation: Download and install Festo Automation Suite version 2.8.0.138 and download the latest, patched version of Codesys directly from the official Codesys website.
Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied.
Regularly monitor Codesys security advisories and apply updates promptly.
Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.
General recommendations: As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits:
- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.
- Use firewalls to protect and separate the control system network from other networks.
- Use VPN (Virtual Private Networks) tunnels if remote access is required.
- Activate and apply user management and password features.
- Use encrypted communication links.
- Limit the access to both development and control system by physical means, operating system features, etc.
- Protect both development and control systems by using up-to-date virus detection solutions.
Festo strongly recommends minimizing and protecting network access to connected devices with state-of-the-art techniques and processes.
To ensure secure operation follow the recommendations in the product manuals.
Disclaimer: Festo assumes no liability whatsoever for indirect, collateral, accidental or consequential losses that occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided free of charge and on good faith by Festo. Insofar as permissible by law, however, none of this information shall establish any warranty, guarantee, commitment, or liability on the part of Festo.
Note: In no case does this information release the operator or responsible person from the obligation to check the effect on his system or installation before using the information and, in the event of negative consequences, not to use the information.
In addition, the actual general terms, and conditions for delivery, payment and software use of Festo, available under http://www.festo.com and the special provisions for the use of Festo Security Advisory available at https://www.festo.com/psirt shall apply.
Legal Notice and Terms of Use: This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
Advisory Conversion Disclaimer: This ICSA is a verbatim republication of Festo SE & Co. KG FSA-202601 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Festo SE & Co. KG directly for any questions regarding this advisory.
Critical infrastructure sectors: Critical Manufacturing
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Untrusted search path vulnerability in the pthread_win32_process_attach_np function in pthreadGC2.dll in Pthreads-win32 2.8.0 allows local users to gain privileges via a Trojan horse quserex.dll file in the current working directory. NOTE: some of these details are obtained from third party information.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity, which may allow the contents of manipulated libraries to be displayed or executed. The issue also exists for source libraries, but 3S-Smart Software Solutions GmbH strongly recommends distributing compiled libraries only.
8.6 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
4.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.
8.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.
7.7 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
CWE-307 - Improper Restriction of Excessive Authentication AttemptsAffected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
9.8 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.
7.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.
5.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
6.6 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
5.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
8.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
6.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0008 | — |
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: CSAFPID-0007 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0009 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0010 | — |
Mitigation
|
|
| Unresolved product id: CSAFPID-0011 | — |
Mitigation
|
References
229 references
Acknowledgments
CERT@VDE
certvde.com
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination and support with this publication",
"urls": [
"https://certvde.com"
]
}
],
"aggregate_severity": {
"namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
}
},
"lang": "en-US",
"notes": [
{
"category": "summary",
"text": "Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.\n\nThis change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.\n\nPlease ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.",
"title": "Summary"
},
{
"category": "description",
"text": "The vulnerabilities covered by this advisory have a broad range of impacts ranging from denial-of-service to disclosure or manipulation/deletion of information.",
"title": "Impact"
},
{
"category": "description",
"text": "Download and install Festo Automation Suite version 2.8.0.138 and download the latest, patched version of Codesys directly from the official Codesys website.\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\nRegularly monitor Codesys security advisories and apply updates promptly.\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"title": "Remediation"
},
{
"category": "general",
"text": "As part of a security strategy, Festo recommends the following general defense measures to reduce the risk of exploits: \n- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\n- Use firewalls to protect and separate the control system network from other networks.\n- Use VPN (Virtual Private Networks) tunnels if remote access is required.\n- Activate and apply user management and password features.\n- Use encrypted communication links.\n- Limit the access to both development and control system by physical means, operating system features, etc. \n- Protect both development and control systems by using up-to-date virus detection solutions.\n\nFesto strongly recommends minimizing and protecting network access to connected devices with state-of-the-art techniques and processes. \nTo ensure secure operation follow the recommendations in the product manuals.",
"title": "General recommendations"
},
{
"category": "legal_disclaimer",
"text": "Festo assumes no liability whatsoever for indirect, collateral, accidental or consequential losses that occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided free of charge and on good faith by Festo. Insofar as permissible by law, however, none of this information shall establish any warranty, guarantee, commitment, or liability on the part of Festo.\n\nNote: In no case does this information release the operator or responsible person from the obligation to check the effect on his system or installation before using the information and, in the event of negative consequences, not to use the information.\n\nIn addition, the actual general terms, and conditions for delivery, payment and software use of Festo, available under http://www.festo.com and the special provisions for the use of Festo Security Advisory available at https://www.festo.com/psirt shall apply.",
"title": "Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
"title": "Legal Notice and Terms of Use"
},
{
"category": "other",
"text": "This ICSA is a verbatim republication of Festo SE \u0026 Co. KG FSA-202601 from a direct conversion of the vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Festo SE \u0026 Co. KG directly for any questions regarding this advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Critical Manufacturing",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - CSAF",
"url": "https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202601.json"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories",
"url": "https://certvde.com/en/advisories/vendor/festo/"
},
{
"category": "external",
"summary": "For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)",
"url": "https://www.festo.com/psirt"
},
{
"category": "self",
"summary": "FSA-202601: Several CODESYS vulnerabilities in Festo Automation Suite - HTML",
"url": "https://certvde.com/en/advisories/VDE-2025-108"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-2595",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2595"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-26-076-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-26-076-01 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
}
],
"title": "CODESYS in Festo Automation Suite",
"tracking": {
"aliases": [
"VDE-2025-108"
],
"current_release_date": "2026-03-17T06:00:00.000000Z",
"generator": {
"date": "2026-03-12T21:34:19.682905Z",
"engine": {
"name": "CISA CSAF Generator",
"version": "1.5.0"
}
},
"id": "ICSA-26-076-01",
"initial_release_date": "2026-02-26T08:00:00.000000Z",
"revision_history": [
{
"date": "2026-02-26T08:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-03-17T06:00:00.000000Z",
"legacy_version": "CISA Republication",
"number": "2",
"summary": "Initial CISA Republication of Festo SE \u0026 Co. KG FSA-202601 advisory"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:generic/\u003c2.8.0.138",
"product": {
"name": "Festo Automation Suite \u003c2.8.0.138",
"product_id": "CSAFPID-0001",
"product_identification_helper": {
"model_numbers": [
"8074657"
],
"x_generic_uris": [
{
"namespace": "Festo:Partnumber",
"uri": "Festo:Partnumber:8074657"
},
{
"namespace": "Festo:Ordercode",
"uri": "Festo:Ordercode:8074657"
},
{
"namespace": "Festo:Website",
"uri": "https://www.festo.com/us/en/a/8074657/?q=8074657%7E%3AfestoSortOrderScored"
}
]
}
}
},
{
"category": "product_version",
"name": "2.8.0.138",
"product": {
"name": "Festo Automation Suite 2.8.0.138",
"product_id": "CSAFPID-0002",
"product_identification_helper": {
"cpe": "cpe:2.3:a:festo:festo_automation_suite:2.8.0.138*:*:*:*:*:*:*:*",
"model_numbers": [
"8074657"
],
"x_generic_uris": [
{
"namespace": "Festo:Partnumber",
"uri": "Festo:Partnumber:8074657"
},
{
"namespace": "Festo:Ordercode",
"uri": "Festo:Ordercode:8074657"
},
{
"namespace": "Festo:Website",
"uri": "https://www.festo.com/us/en/a/8074657/?q=8074657%7E%3AfestoSortOrderScored"
}
]
}
}
},
{
"category": "product_version",
"name": "2.8.0.137",
"product": {
"name": "Festo Automation Suite 2.8.0.137",
"product_id": "CSAFPID-0003",
"product_identification_helper": {
"cpe": "cpe:2.3:a:festo:festo_automation_suite:2.8.0.138*:*:*:*:*:*:*:*",
"model_numbers": [
"8074657"
],
"x_generic_uris": [
{
"namespace": "Festo:Partnumber",
"uri": "Festo:Ordercode:8074657"
},
{
"namespace": "Festo:Ordercode",
"uri": "Festo:Ordercode:8074657"
},
{
"namespace": "Festo:Wesite",
"uri": "https://www.festo.com/us/en/a/8074657/?q=8074657%7E%3AfestoSortOrderScored"
}
]
}
}
}
],
"category": "product_name",
"name": "Festo Automation Suite"
}
],
"category": "product_family",
"name": "Software"
}
],
"category": "vendor",
"name": "FESTO"
},
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "3.5.21.20",
"product": {
"name": "CODESYS Development System 3.5.21.20",
"product_id": "CSAFPID-0004",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.5.21.20*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "3.0",
"product": {
"name": "CODESYS Development System 3.0",
"product_id": "CSAFPID-0005",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version",
"name": "3.5.16.10",
"product": {
"name": "CODESYS Development System 3.5.16.10",
"product_id": "CSAFPID-0006",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.5.16.10:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "CODESYS Development System"
}
],
"category": "product_family",
"name": "Software"
}
],
"category": "vendor",
"name": "CODESYS"
}
],
"product_groups": [
{
"group_id": "CSAFGID-0001",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
],
"summary": "Affected Products."
}
],
"relationships": [
{
"category": "installed_with",
"full_product_name": {
"name": "Festo Automation Suite \u003c2.8.0.138 installed with CODESYS Development System 3.0",
"product_id": "CSAFPID-0007",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.0:*:*:*:*:*:*:*"
}
},
"product_reference": "CSAFPID-0001",
"relates_to_product_reference": "CSAFPID-0005"
},
{
"category": "external_component_of",
"full_product_name": {
"name": "CODESYS Development System 3.5.21.20 external component of Festo Automation Suite 2.8.0.138",
"product_id": "CSAFPID-0008",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.5.21.20*:*:*:*:*:*:*:*"
}
},
"product_reference": "CSAFPID-0004",
"relates_to_product_reference": "CSAFPID-0002"
},
{
"category": "installed_with",
"full_product_name": {
"name": "Festo Automation Suite \u003c2.8.0.138 installed with CODESYS Development System 3.5.16.10",
"product_id": "CSAFPID-0009",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.5.16.10:*:*:*:*:*:*:*"
}
},
"product_reference": "CSAFPID-0001",
"relates_to_product_reference": "CSAFPID-0006"
},
{
"category": "installed_with",
"full_product_name": {
"name": "Festo Automation Suite 2.8.0.137 installed with CODESYS Development System 3.0",
"product_id": "CSAFPID-0010",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.0:*:*:*:*:*:*:*"
}
},
"product_reference": "CSAFPID-0003",
"relates_to_product_reference": "CSAFPID-0005"
},
{
"category": "installed_with",
"full_product_name": {
"name": "Festo Automation Suite 2.8.0.137 installed with CODESYS Development System 3.5.16.10",
"product_id": "CSAFPID-0011",
"product_identification_helper": {
"cpe": "cpe:2.3:a:codesys:development_system:3.5.16.10:*:*:*:*:*:*:*"
}
},
"product_reference": "CSAFPID-0003",
"relates_to_product_reference": "CSAFPID-0006"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-2595",
"cwe": {
"id": "CWE-425",
"name": "Direct Request (\u0027Forced Browsing\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2595"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/425.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\n\nDownload the latest, patched version of Codesys directly from the official Codesys website.\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\nRegularly monitor Codesys security advisories and apply updates promptly.\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2025-2595"
},
{
"cve": "CVE-2010-5250",
"cwe": {
"id": "CWE-426",
"name": "Untrusted Search Path"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Untrusted search path vulnerability in the pthread_win32_process_attach_np function in pthreadGC2.dll in Pthreads-win32 2.8.0 allows local users to gain privileges via a Trojan horse quserex.dll file in the current working directory. NOTE: some of these details are obtained from third party information.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-5250"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/426.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"environmentalScore": 6.9,
"integrityImpact": "COMPLETE",
"temporalScore": 6.9,
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2010-5250"
},
{
"cve": "CVE-2017-3735",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3735"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2017-3735"
},
{
"cve": "CVE-2018-0739",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0739"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/674.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2018-0739"
},
{
"cve": "CVE-2018-10612",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10612"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/284.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2018-10612"
},
{
"cve": "CVE-2018-20025",
"cwe": {
"id": "CWE-330",
"name": "Use of Insufficiently Random Values"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20025"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/330.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2018-20025"
},
{
"cve": "CVE-2018-20026",
"cwe": {
"id": "CWE-923",
"name": "Improper Restriction of Communication Channel to Intended Endpoints"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20026"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/923.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2018-20026"
},
{
"cve": "CVE-2019-13532",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13532"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-13532"
},
{
"cve": "CVE-2019-13538",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity, which may allow the contents of manipulated libraries to be displayed or executed. The issue also exists for source libraries, but 3S-Smart Software Solutions GmbH strongly recommends distributing compiled libraries only.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13538"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.6,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 8.6,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-13538"
},
{
"cve": "CVE-2019-13542",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13542"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-13542"
},
{
"cve": "CVE-2019-13548",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13548"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-13548"
},
{
"cve": "CVE-2019-18858",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18858"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/120.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-18858"
},
{
"cve": "CVE-2019-19789",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19789"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-19789"
},
{
"cve": "CVE-2019-5105",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5105"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-5105"
},
{
"cve": "CVE-2019-9008",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9008"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/732.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-9008"
},
{
"cve": "CVE-2019-9009",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9009"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/755.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-9009"
},
{
"cve": "CVE-2019-9010",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9010"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/284.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-9010"
},
{
"cve": "CVE-2019-9011",
"cwe": {
"id": "CWE-668",
"name": "Exposure of Resource to Wrong Sphere"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9011"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/668.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-9011"
},
{
"cve": "CVE-2019-9012",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9012"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/770.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-9012"
},
{
"cve": "CVE-2019-9013",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9013"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/327.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2019-9013"
},
{
"cve": "CVE-2020-10245",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10245"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-10245"
},
{
"cve": "CVE-2020-12067",
"cwe": {
"id": "CWE-640",
"name": "Weak Password Recovery Mechanism for Forgotten Password"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user\u0027s password may be changed by an attacker without knowledge of the current password.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12067"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/640.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-12067"
},
{
"cve": "CVE-2020-12068",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12068"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/269.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-12068"
},
{
"cve": "CVE-2020-12069",
"cwe": {
"id": "CWE-916",
"name": "Use of Password Hash With Insufficient Computational Effort"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12069"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/916.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-12069"
},
{
"cve": "CVE-2020-14509",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14509"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/805.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-14509"
},
{
"cve": "CVE-2020-14513",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverified length fields.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14513"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-14513"
},
{
"cve": "CVE-2020-14515",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14515"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/347.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-14515"
},
{
"cve": "CVE-2020-14517",
"cwe": {
"id": "CWE-326",
"name": "Inadequate Encryption Strength"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server) and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14517"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/326.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-14517"
},
{
"cve": "CVE-2020-14519",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a web server) via a specifically crafted Java Script payload, which may allow alteration or creation of license files for when combined with CVE-2020-14515.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14519"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/346.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-14519"
},
{
"cve": "CVE-2020-15806",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15806"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/401.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-15806"
},
{
"cve": "CVE-2020-16233",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data from the heap.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-16233"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/404.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-16233"
},
{
"cve": "CVE-2020-7052",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7052"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/770.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-7052"
},
{
"cve": "CVE-2021-21863",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21863"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21863"
},
{
"cve": "CVE-2021-21864",
"cwe": {
"id": "CWE-50",
"name": "Path Equivalence: \u0027//multiple/leading/slash\u0027"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21864"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/50.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21864"
},
{
"cve": "CVE-2021-21865",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21865"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21865"
},
{
"cve": "CVE-2021-21866",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21866"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21866"
},
{
"cve": "CVE-2021-21867",
"cwe": {
"id": "CWE-50",
"name": "Path Equivalence: \u0027//multiple/leading/slash\u0027"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21867"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/50.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21867"
},
{
"cve": "CVE-2021-21868",
"cwe": {
"id": "CWE-50",
"name": "Path Equivalence: \u0027//multiple/leading/slash\u0027"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21868"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/50.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21868"
},
{
"cve": "CVE-2021-21869",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-21869"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-21869"
},
{
"cve": "CVE-2021-29239",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29239"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/345.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-29239"
},
{
"cve": "CVE-2021-29240",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29240"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/345.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-29240"
},
{
"cve": "CVE-2021-29241",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29241"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-29241"
},
{
"cve": "CVE-2021-29242",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router\u0027s addressing scheme and may re-route, add, remove or change low level communication packages.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29242"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"environmentalScore": 7.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.3,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-29242"
},
{
"cve": "CVE-2021-30186",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30186"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-30186"
},
{
"cve": "CVE-2021-30187",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30187"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-30187"
},
{
"cve": "CVE-2021-30188",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30188"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-30188"
},
{
"cve": "CVE-2021-30190",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30190"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/306.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-30190"
},
{
"cve": "CVE-2021-30195",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30195"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/125.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-30195"
},
{
"cve": "CVE-2021-33485",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33485"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-33485"
},
{
"cve": "CVE-2021-33486",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33486"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/755.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-33486"
},
{
"cve": "CVE-2021-34593",
"cwe": {
"id": "CWE-75",
"name": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34593"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/75.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-34593"
},
{
"cve": "CVE-2021-34595",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34595"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/823.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 8.1,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.1,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-34595"
},
{
"cve": "CVE-2021-34596",
"cwe": {
"id": "CWE-82",
"name": "Improper Neutralization of Script in Attributes of IMG Tags in a Web Page"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34596"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/82.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-34596"
},
{
"cve": "CVE-2021-36763",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36763"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/552.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-36763"
},
{
"cve": "CVE-2021-36764",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36764"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-36764"
},
{
"cve": "CVE-2021-36765",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-36765"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2021-36765"
},
{
"cve": "CVE-2022-1965",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1965"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/755.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 8.1,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.1,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-1965"
},
{
"cve": "CVE-2022-1989",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-1989"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-1989"
},
{
"cve": "CVE-2022-22508",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22508"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22508"
},
{
"cve": "CVE-2022-22513",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22513"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/476.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22513"
},
{
"cve": "CVE-2022-22514",
"cwe": {
"id": "CWE-822",
"name": "Untrusted Pointer Dereference"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22514"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/822.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.1,
"environmentalSeverity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.1,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22514"
},
{
"cve": "CVE-2022-22515",
"cwe": {
"id": "CWE-668",
"name": "Exposure of Resource to Wrong Sphere"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22515"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/668.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.1,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.1,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22515"
},
{
"cve": "CVE-2022-22516",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22516"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/732.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22516"
},
{
"cve": "CVE-2022-22517",
"cwe": {
"id": "CWE-33",
"name": "Path Traversal: \u0027....\u0027 (Multiple Dot)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22517"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/33.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22517"
},
{
"cve": "CVE-2022-22519",
"cwe": {
"id": "CWE-12",
"name": "ASP.NET Misconfiguration: Missing Custom Error Page"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the CODESYS Control runtime system.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22519"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/12.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-22519"
},
{
"cve": "CVE-2022-30791",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30791"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-30791"
},
{
"cve": "CVE-2022-30792",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30792"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-30792"
},
{
"cve": "CVE-2022-31805",
"cwe": {
"id": "CWE-523",
"name": "Unprotected Transport of Credentials"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31805"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/523.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-31805"
},
{
"cve": "CVE-2022-31806",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31806"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/1188.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-31806"
},
{
"cve": "CVE-2022-32136",
"cwe": {
"id": "CWE-82",
"name": "Improper Neutralization of Script in Attributes of IMG Tags in a Web Page"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32136"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/82.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32136"
},
{
"cve": "CVE-2022-32137",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32137"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/122.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32137"
},
{
"cve": "CVE-2022-32138",
"cwe": {
"id": "CWE-194",
"name": "Unexpected Sign Extension"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32138"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/194.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32138"
},
{
"cve": "CVE-2022-32139",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32139"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/125.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32139"
},
{
"cve": "CVE-2022-32140",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32140"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/120.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32140"
},
{
"cve": "CVE-2022-32141",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32141"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/126.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32141"
},
{
"cve": "CVE-2022-32142",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32142"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/823.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 8.1,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.1,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32142"
},
{
"cve": "CVE-2022-32143",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32143"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/552.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-32143"
},
{
"cve": "CVE-2022-4046",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-4046"
},
{
"cve": "CVE-2022-4048",
"cwe": {
"id": "CWE-326",
"name": "Inadequate Encryption Strength"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4048"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/326.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.7,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-4048"
},
{
"cve": "CVE-2022-4224",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4224"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/1188.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-4224"
},
{
"cve": "CVE-2022-47378",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47378"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47378"
},
{
"cve": "CVE-2022-47379",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47379"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47379"
},
{
"cve": "CVE-2022-47380",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47380"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47380"
},
{
"cve": "CVE-2022-47381",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47381"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47381"
},
{
"cve": "CVE-2022-47383",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47383"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47383"
},
{
"cve": "CVE-2022-47384",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47384"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47384"
},
{
"cve": "CVE-2022-47385",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47385"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47385"
},
{
"cve": "CVE-2022-47386",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47386"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47386"
},
{
"cve": "CVE-2022-47387",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47387"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47387"
},
{
"cve": "CVE-2022-47388",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47388"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47388"
},
{
"cve": "CVE-2022-47389",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47389"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47389"
},
{
"cve": "CVE-2022-47390",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47390"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47390"
},
{
"cve": "CVE-2022-47391",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47391"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47391"
},
{
"cve": "CVE-2022-47392",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47392"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47392"
},
{
"cve": "CVE-2022-47393",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47393"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47393"
},
{
"cve": "CVE-2023-3662",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3662"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/427.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.3,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-3662"
},
{
"cve": "CVE-2023-3663",
"cwe": {
"id": "CWE-940",
"name": "Improper Verification of Source of a Communication Channel"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3663"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/940.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-3663"
},
{
"cve": "CVE-2023-3669",
"cwe": {
"id": "CWE-307",
"name": "Improper Restriction of Excessive Authentication Attempts"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3669"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/307.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"environmentalScore": 3.3,
"environmentalSeverity": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 3.3,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-3669"
},
{
"cve": "CVE-2023-3670",
"cwe": {
"id": "CWE-668",
"name": "Exposure of Resource to Wrong Sphere"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3670"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/668.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.3,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-3670"
},
{
"cve": "CVE-2023-37545",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37545"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37545"
},
{
"cve": "CVE-2023-37546",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37546"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37546"
},
{
"cve": "CVE-2023-37547",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37547"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37547"
},
{
"cve": "CVE-2023-37548",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37548"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37548"
},
{
"cve": "CVE-2023-37549",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37549"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37549"
},
{
"cve": "CVE-2023-37550",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37550"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37550"
},
{
"cve": "CVE-2023-37551",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37551"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/552.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37551"
},
{
"cve": "CVE-2023-37552",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37552"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37552"
},
{
"cve": "CVE-2023-37553",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37553"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37553"
},
{
"cve": "CVE-2023-37554",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37554"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37554"
},
{
"cve": "CVE-2023-37555",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37555"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37555"
},
{
"cve": "CVE-2023-37556",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37556"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37556"
},
{
"cve": "CVE-2023-37557",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37557"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37557"
},
{
"cve": "CVE-2023-37558",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37558"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37558"
},
{
"cve": "CVE-2023-37559",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37559"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-37559"
},
{
"cve": "CVE-2023-3935",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3935"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-3935"
},
{
"cve": "CVE-2023-49675",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49675"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-49675"
},
{
"cve": "CVE-2023-49676",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49676"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/416.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-49676"
},
{
"cve": "CVE-2023-6357",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6357"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2023-6357"
},
{
"cve": "CVE-2024-5000",
"cwe": {
"id": "CWE-13",
"name": "ASP.NET Misconfiguration: Password in Configuration File"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.\r\n\r\n",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5000"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/13.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2024-5000"
},
{
"cve": "CVE-2024-8175",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8175"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/754.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2024-8175"
},
{
"cve": "CVE-2025-0694",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0694"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"environmentalScore": 6.6,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2025-0694"
},
{
"cve": "CVE-2025-1468",
"cwe": {
"id": "CWE-203",
"name": "Observable Discrepancy"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1468"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/203.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2025-1468"
},
{
"cve": "CVE-2025-41658",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-41658"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"environmentalScore": 5.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 5.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2025-41658"
},
{
"cve": "CVE-2025-41659",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-41659"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/732.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.3,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.3,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2025-41659"
},
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"environmentalScore": 6.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 6.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2022-47382",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"audience": "all",
"category": "description",
"text": "An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-47382"
},
{
"category": "external",
"summary": "cwe.mitre.org",
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to:\r\n\r\nDownload the latest, patched version of Codesys directly from the official Codesys website.\r\nFollow the installation and update instructions provided by Codesys to ensure all security fixes are applied.\r\nRegularly monitor Codesys security advisories and apply updates promptly.\r\nMaintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011"
]
}
],
"title": "CVE-2022-47382"
}
]
}
NCSC-2024-0417
Vulnerability from csaf_ncscnl - Published: 2024-10-17 13:19 - Updated: 2024-10-17 13:19Summary
Kwetsbaarheden verholpen in Oracle Fusion Middleware
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.
Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipuleren van data
- Uitvoer van willekeurige code (Administratorrechten)
- Toegang tot gevoelige gegevens
Omdat deze kwetsbaarheden zich bevinden in diverse Middleware producten, is niet uit te sluiten dat applicaties, draaiende op platformen ondersteund door deze middleware ook kwetsbaar zijn, danwel gevoelig voor misbruik van deze kwetsbaarheden.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer infomatie.
Kans: medium
Schade: high
CWE-1325: Improperly Controlled Sequential Memory Allocation
CWE-390: Detection of Error Condition Without Action
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-178: Improper Handling of Case Sensitivity
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-190: Integer Overflow or Wraparound
CWE-404: Improper Resource Shutdown or Release
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-416: Use After Free
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-502: Deserialization of Untrusted Data
CWE-918: Server-Side Request Forgery (SSRF)
CWE-787: Out-of-bounds Write
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-20: Improper Input Validation
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.9 (Medium)
Affected products
Known affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*
|
— | |
|
business_process_management_suite
oracle
|
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:9.1.0.0.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites_support_tools
oracle
|
cpe:2.3:a:oracle:webcenter_sites_support_tools:*:*:*:*:*:*:*:*
|
— |
5.5 (Medium)
Affected products
Known affected
38 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_process_management_suite
oracle
|
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:9.1.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_console___14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_third_party___14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring__bam_
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring__bam_:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring__bam_
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring__bam_:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
business_process_management_suite
oracle
|
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:9.1.0.0.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites_support_tools
oracle
|
cpe:2.3:a:oracle:webcenter_sites_support_tools:*:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:*:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:all_supported_s:*:*:*:*:*:*:*
|
— |
CWE-502
- Deserialization of Untrusted Data
Affected products
Known affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_process_management_suite
oracle
|
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:9.1.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_console___14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:_third_party___14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_enterprise_capture
oracle
|
cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
8.8 (High)
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.1 (High)
Affected products
Known affected
20 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_process_management_suite
oracle
|
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_enterprise_capture
oracle
|
cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
5.3 (Medium)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
18 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_enterprise_capture
oracle
|
cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
CWE-94
- Improper Control of Generation of Code ('Code Injection')
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
global_lifecycle_management_fmw_installer
oracle
|
cpe:2.3:a:oracle:global_lifecycle_management_fmw_installer:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
7.6 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
enterprise_manager_fusion_middleware_control
oracle
|
cpe:2.3:a:oracle:enterprise_manager_fusion_middleware_control:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
9.8 (Critical)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
18 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_enterprise_capture
oracle
|
cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
8.1 (High)
Affected products
Known affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
webcenter_forms_recognition
oracle
|
cpe:2.3:a:oracle:webcenter_forms_recognition:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
8.1 (High)
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
18 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
managed_file_transfer
oracle
|
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
identity_manager_connector
oracle
|
cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_enterprise_capture
oracle
|
cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server_proxy_plug-in
oracle
|
cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
9.3 (Critical)
Affected products
Known affected
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
webcenter_forms_recognition
oracle
|
cpe:2.3:a:oracle:webcenter_forms_recognition:14.1.1.0.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.3 (High)
Affected products
Known affected
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
data_integrator
oracle
|
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
http_server
oracle
|
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
middleware_common_libraries_and_tools
oracle
|
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— | |
|
webcenter_content
oracle
|
cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_portal
oracle
|
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
webcenter_sites
oracle
|
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
weblogic_server
oracle
|
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
|
— |
7.5 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— |
10.0 (Critical)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
business_process_management_suite
oracle
|
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
|
— | |
|
business_activity_monitoring
oracle
|
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
— |
9.8 (Critical)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
outside_in_technology
oracle
|
cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*
|
— |
References
31 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft kwetsbaarheden verholpen in Fusion Middleware componenten, zoals WebLogic Server, WebCenter en HTTP Server.",
"title": "Feiten"
},
{
"category": "description",
"text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Manipuleren van data\n- Uitvoer van willekeurige code (Administratorrechten)\n- Toegang tot gevoelige gegevens\n\nOmdat deze kwetsbaarheden zich bevinden in diverse Middleware producten, is niet uit te sluiten dat applicaties, draaiende op platformen ondersteund door deze middleware ook kwetsbaar zijn, danwel gevoelig voor misbruik van deze kwetsbaarheden.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer infomatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improperly Controlled Sequential Memory Allocation",
"title": "CWE-1325"
},
{
"category": "general",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "general",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "general",
"text": "Improper Handling of Case Sensitivity",
"title": "CWE-178"
},
{
"category": "general",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - cveprojectv5; hkcert; nvd; oracle; redhat",
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Fusion Middleware",
"tracking": {
"current_release_date": "2024-10-17T13:19:16.185510Z",
"id": "NCSC-2024-0417",
"initial_release_date": "2024-10-17T13:19:16.185510Z",
"revision_history": [
{
"date": "2024-10-17T13:19:16.185510Z",
"number": "0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "outside_in_technology",
"product": {
"name": "outside_in_technology",
"product_id": "CSAFPID-292093",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "outside_in_technology",
"product": {
"name": "outside_in_technology",
"product_id": "CSAFPID-1260",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:outside_in_technology:8.5.6:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "outside_in_technology",
"product": {
"name": "outside_in_technology",
"product_id": "CSAFPID-912053",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:outside_in_technology:8.5.7:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server_proxy_plug-in",
"product": {
"name": "weblogic_server_proxy_plug-in",
"product_id": "CSAFPID-199883",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server_proxy_plug-in",
"product": {
"name": "weblogic_server_proxy_plug-in",
"product_id": "CSAFPID-951239",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764797",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764799",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_console___12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764801",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_console___14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764798",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764800",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_third_party___12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-764802",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:_third_party___14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-113536",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-113521",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-3663",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-94310",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-3661",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-3660",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-1504444",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "weblogic_server",
"product": {
"name": "weblogic_server",
"product_id": "CSAFPID-1973",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_content",
"product": {
"name": "webcenter_content",
"product_id": "CSAFPID-389123",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_content:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_content",
"product": {
"name": "webcenter_content",
"product_id": "CSAFPID-179795",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_enterprise_capture",
"product": {
"name": "webcenter_enterprise_capture",
"product_id": "CSAFPID-912594",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_forms_recognition",
"product": {
"name": "webcenter_forms_recognition",
"product_id": "CSAFPID-1673476",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_forms_recognition:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_portal",
"product": {
"name": "webcenter_portal",
"product_id": "CSAFPID-135359",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_portal",
"product": {
"name": "webcenter_portal",
"product_id": "CSAFPID-45194",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites_support_tools",
"product": {
"name": "webcenter_sites_support_tools",
"product_id": "CSAFPID-765268",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites_support_tools:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites",
"product": {
"name": "webcenter_sites",
"product_id": "CSAFPID-9026",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites",
"product": {
"name": "webcenter_sites",
"product_id": "CSAFPID-135354",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "webcenter_sites",
"product": {
"name": "webcenter_sites",
"product_id": "CSAFPID-765390",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:webcenter_sites:all_supported_s:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "data_integrator",
"product": {
"name": "data_integrator",
"product_id": "CSAFPID-204494",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "data_integrator",
"product": {
"name": "data_integrator",
"product_id": "CSAFPID-204566",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_activity_monitoring__bam_",
"product": {
"name": "business_activity_monitoring__bam_",
"product_id": "CSAFPID-764927",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_activity_monitoring__bam_:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_activity_monitoring__bam_",
"product": {
"name": "business_activity_monitoring__bam_",
"product_id": "CSAFPID-764928",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_activity_monitoring__bam_:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_activity_monitoring",
"product": {
"name": "business_activity_monitoring",
"product_id": "CSAFPID-228157",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_process_management_suite",
"product": {
"name": "business_process_management_suite",
"product_id": "CSAFPID-9043",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "business_process_management_suite",
"product": {
"name": "business_process_management_suite",
"product_id": "CSAFPID-9642",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "middleware_common_libraries_and_tools",
"product": {
"name": "middleware_common_libraries_and_tools",
"product_id": "CSAFPID-94398",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "middleware_common_libraries_and_tools",
"product": {
"name": "middleware_common_libraries_and_tools",
"product_id": "CSAFPID-94309",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "middleware_common_libraries_and_tools",
"product": {
"name": "middleware_common_libraries_and_tools",
"product_id": "CSAFPID-94393",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "enterprise_manager_fusion_middleware_control",
"product": {
"name": "enterprise_manager_fusion_middleware_control",
"product_id": "CSAFPID-1673426",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:enterprise_manager_fusion_middleware_control:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "global_lifecycle_management_fmw_installer",
"product": {
"name": "global_lifecycle_management_fmw_installer",
"product_id": "CSAFPID-1673425",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:global_lifecycle_management_fmw_installer:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "http_server",
"product": {
"name": "http_server",
"product_id": "CSAFPID-93909",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "http_server",
"product": {
"name": "http_server",
"product_id": "CSAFPID-40303",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "http_server",
"product": {
"name": "http_server",
"product_id": "CSAFPID-912074",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "managed_file_transfer",
"product": {
"name": "managed_file_transfer",
"product_id": "CSAFPID-204452",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "managed_file_transfer",
"product": {
"name": "managed_file_transfer",
"product_id": "CSAFPID-204581",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-765382",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-227776",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-396523",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:12.2.1.3.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-204638",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:9.1.0:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "identity_manager_connector",
"product": {
"name": "identity_manager_connector",
"product_id": "CSAFPID-765267",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:identity_manager_connector:9.1.0.0.0:*:*:*:*:*:*:*"
}
}
}
],
"category": "vendor",
"name": "oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-135354",
"CSAFPID-9026",
"CSAFPID-3663",
"CSAFPID-3661",
"CSAFPID-94310",
"CSAFPID-113521",
"CSAFPID-113536",
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-204581",
"CSAFPID-94309",
"CSAFPID-1260",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-204494",
"CSAFPID-93909",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-765268"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2020-11023",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-11023.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-135354",
"CSAFPID-9026",
"CSAFPID-3663",
"CSAFPID-3661",
"CSAFPID-94310",
"CSAFPID-113521",
"CSAFPID-113536",
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-204581",
"CSAFPID-94309",
"CSAFPID-1260",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-204494",
"CSAFPID-93909",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-765268"
]
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-17521",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-396523",
"CSAFPID-204638",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-204581",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-764797",
"CSAFPID-764798",
"CSAFPID-3661",
"CSAFPID-764799",
"CSAFPID-764800",
"CSAFPID-764801",
"CSAFPID-764802",
"CSAFPID-764927",
"CSAFPID-764928",
"CSAFPID-9043",
"CSAFPID-93909",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-9026",
"CSAFPID-204494",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-765268",
"CSAFPID-227776",
"CSAFPID-94310",
"CSAFPID-765382",
"CSAFPID-292093",
"CSAFPID-94393",
"CSAFPID-765390"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2020-17521",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-17521.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-396523",
"CSAFPID-204638",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-204581",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-764797",
"CSAFPID-764798",
"CSAFPID-3661",
"CSAFPID-764799",
"CSAFPID-764800",
"CSAFPID-764801",
"CSAFPID-764802",
"CSAFPID-764927",
"CSAFPID-764928",
"CSAFPID-9043",
"CSAFPID-93909",
"CSAFPID-94398",
"CSAFPID-389123",
"CSAFPID-135359",
"CSAFPID-9026",
"CSAFPID-204494",
"CSAFPID-765267",
"CSAFPID-204452",
"CSAFPID-765268",
"CSAFPID-227776",
"CSAFPID-94310",
"CSAFPID-765382",
"CSAFPID-292093",
"CSAFPID-94393",
"CSAFPID-765390"
]
}
],
"title": "CVE-2020-17521"
},
{
"cve": "CVE-2022-1471",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-204581",
"CSAFPID-94309",
"CSAFPID-1260",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-3661",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-396523",
"CSAFPID-204638",
"CSAFPID-135354",
"CSAFPID-764797",
"CSAFPID-764798",
"CSAFPID-764799",
"CSAFPID-764800",
"CSAFPID-764801",
"CSAFPID-764802",
"CSAFPID-199883",
"CSAFPID-912074",
"CSAFPID-94393",
"CSAFPID-912053",
"CSAFPID-912594",
"CSAFPID-951239"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-1471",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-1471.json"
}
],
"title": "CVE-2022-1471"
},
{
"cve": "CVE-2023-4759",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "other",
"text": "Improper Handling of Case Sensitivity",
"title": "CWE-178"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-4759",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4759.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2023-4759"
},
{
"cve": "CVE-2023-35116",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-40303",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-3661",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-199883",
"CSAFPID-951239",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-94393",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-35116",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-35116.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-9642",
"CSAFPID-40303",
"CSAFPID-1260",
"CSAFPID-45194",
"CSAFPID-3661",
"CSAFPID-3660",
"CSAFPID-1973",
"CSAFPID-199883",
"CSAFPID-951239",
"CSAFPID-94309",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-94393",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2023-35116"
},
{
"cve": "CVE-2023-39743",
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-39743",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39743.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2023-39743"
},
{
"cve": "CVE-2023-51775",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-199883",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-51775",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-51775.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-199883",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2023-51775"
},
{
"cve": "CVE-2024-2511",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Improperly Controlled Sequential Memory Allocation",
"title": "CWE-1325"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-2511",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-2511"
},
{
"cve": "CVE-2024-6345",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-6345",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-6345.json"
}
],
"title": "CVE-2024-6345"
},
{
"cve": "CVE-2024-21190",
"product_status": {
"known_affected": [
"CSAFPID-1673425"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21190",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21190.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673425"
]
}
],
"title": "CVE-2024-21190"
},
{
"cve": "CVE-2024-21191",
"product_status": {
"known_affected": [
"CSAFPID-1673426"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21191",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21191.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673426"
]
}
],
"title": "CVE-2024-21191"
},
{
"cve": "CVE-2024-21192",
"references": [
{
"category": "self",
"summary": "CVE-2024-21192",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21192.json"
}
],
"title": "CVE-2024-21192"
},
{
"cve": "CVE-2024-21205",
"references": [
{
"category": "self",
"summary": "CVE-2024-21205",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21205.json"
}
],
"title": "CVE-2024-21205"
},
{
"cve": "CVE-2024-21215",
"product_status": {
"known_affected": [
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21215",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21215.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-21215"
},
{
"cve": "CVE-2024-21216",
"product_status": {
"known_affected": [
"CSAFPID-1973",
"CSAFPID-3660"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21216",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21216.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1973",
"CSAFPID-3660"
]
}
],
"title": "CVE-2024-21216"
},
{
"cve": "CVE-2024-21234",
"product_status": {
"known_affected": [
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21234",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21234.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-21234"
},
{
"cve": "CVE-2024-21246",
"references": [
{
"category": "self",
"summary": "CVE-2024-21246",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21246.json"
}
],
"title": "CVE-2024-21246"
},
{
"cve": "CVE-2024-21260",
"product_status": {
"known_affected": [
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21260",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21260.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-21260"
},
{
"cve": "CVE-2024-21274",
"product_status": {
"known_affected": [
"CSAFPID-1973",
"CSAFPID-3660"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-21274",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21274.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1973",
"CSAFPID-3660"
]
}
],
"title": "CVE-2024-21274"
},
{
"cve": "CVE-2024-22201",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-22201",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22201.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2024-22201"
},
{
"cve": "CVE-2024-22262",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"notes": [
{
"category": "other",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-22262",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22262.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-22262"
},
{
"cve": "CVE-2024-23807",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-23807",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23807.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-23807"
},
{
"cve": "CVE-2024-24549",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-24549",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24549.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-199883",
"CSAFPID-1260",
"CSAFPID-1973",
"CSAFPID-3660",
"CSAFPID-40303",
"CSAFPID-45194",
"CSAFPID-94309",
"CSAFPID-94393",
"CSAFPID-179795",
"CSAFPID-204566",
"CSAFPID-204581",
"CSAFPID-396523",
"CSAFPID-912053",
"CSAFPID-912074",
"CSAFPID-912594",
"CSAFPID-951239",
"CSAFPID-228157",
"CSAFPID-135354"
]
}
],
"title": "CVE-2024-24549"
},
{
"cve": "CVE-2024-25269",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
}
],
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-25269",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-25269.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2024-25269"
},
{
"cve": "CVE-2024-28182",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"product_status": {
"known_affected": [
"CSAFPID-912074",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-28182",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28182.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-912074",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-28182"
},
{
"cve": "CVE-2024-28752",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-28752",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28752.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1673476",
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-28752"
},
{
"cve": "CVE-2024-29131",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-29131",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29131.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-228157",
"CSAFPID-204566",
"CSAFPID-40303",
"CSAFPID-94309",
"CSAFPID-912053",
"CSAFPID-179795",
"CSAFPID-45194",
"CSAFPID-135354",
"CSAFPID-3660",
"CSAFPID-1973"
]
}
],
"title": "CVE-2024-29131"
},
{
"cve": "CVE-2024-36052",
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-36052",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36052.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2024-36052"
},
{
"cve": "CVE-2024-38999",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9642",
"CSAFPID-228157"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-38999",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38999.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-9642",
"CSAFPID-228157"
]
}
],
"title": "CVE-2024-38999"
},
{
"cve": "CVE-2024-45492",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
}
],
"product_status": {
"known_affected": [
"CSAFPID-912053"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-45492",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45492.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-912053"
]
}
],
"title": "CVE-2024-45492"
}
]
}
OPENSUSE-SU-2020:1060-1
Vulnerability from csaf_opensuse - Published: 2020-07-25 18:21 - Updated: 2020-07-25 18:21Summary
Security update for cacti, cacti-spine
Severity
Moderate
Notes
Title of the patch: Security update for cacti, cacti-spine
Description of the patch: This update for cacti, cacti-spine fixes the following issues:
- cacti 1.2.13:
* Query XSS vulnerabilities require vendor package update
(CVE-2020-11022 / CVE-2020-11023)
* Lack of escaping on some pages can lead to XSS exposure
* Update PHPMailer to 6.1.6 (CVE-2020-13625)
* SQL Injection vulnerability due to input validation failure when
editing colors (CVE-2020-14295, boo#1173090)
* Lack of escaping on template import can lead to XSS exposure
- switch from cron to systemd timers (boo#1115436):
+ cacti-cron.timer
+ cacti-cron.service
- avoid potential root escalation on systems with fs.protected_hardlinks=0
(boo#1154087): handle directory permissions in file section instead
of using chown during post installation
- rewrote apache configuration to get rid of .htaccess files and
explicitely disable directory permissions per default
(only allow a limited, well-known set of directories)
Patchnames: openSUSE-2020-1060
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.1 (Medium)
Affected products
Recommended
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 12:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 12:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 12:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.2 (High)
Affected products
Recommended
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 12:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
23 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for cacti, cacti-spine",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for cacti, cacti-spine fixes the following issues:\n\n- cacti 1.2.13:\n\n * Query XSS vulnerabilities require vendor package update\n (CVE-2020-11022 / CVE-2020-11023)\n * Lack of escaping on some pages can lead to XSS exposure\n * Update PHPMailer to 6.1.6 (CVE-2020-13625)\n * SQL Injection vulnerability due to input validation failure when\n editing colors (CVE-2020-14295, boo#1173090)\n * Lack of escaping on template import can lead to XSS exposure\n\n- switch from cron to systemd timers (boo#1115436):\n + cacti-cron.timer\n + cacti-cron.service\n- avoid potential root escalation on systems with fs.protected_hardlinks=0\n (boo#1154087): handle directory permissions in file section instead\n of using chown during post installation\n- rewrote apache configuration to get rid of .htaccess files and \n explicitely disable directory permissions per default \n (only allow a limited, well-known set of directories)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1060",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1060-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1060-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VVPI65AW45TXMRAYCWJ6YJT3LF4GIMWL/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1060-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VVPI65AW45TXMRAYCWJ6YJT3LF4GIMWL/"
},
{
"category": "self",
"summary": "SUSE Bug 1115436",
"url": "https://bugzilla.suse.com/1115436"
},
{
"category": "self",
"summary": "SUSE Bug 1154087",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "self",
"summary": "SUSE Bug 1173090",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11023 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
}
],
"title": "Security update for cacti, cacti-spine",
"tracking": {
"current_release_date": "2020-07-25T18:21:21Z",
"generator": {
"date": "2020-07-25T18:21:21Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1060-1",
"initial_release_date": "2020-07-25T18:21:21Z",
"revision_history": [
{
"date": "2020-07-25T18:21:21Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.aarch64",
"product": {
"name": "cacti-spine-1.2.13-8.1.aarch64",
"product_id": "cacti-spine-1.2.13-8.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.13-11.1.noarch",
"product": {
"name": "cacti-1.2.13-11.1.noarch",
"product_id": "cacti-1.2.13-11.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.ppc64le",
"product": {
"name": "cacti-spine-1.2.13-8.1.ppc64le",
"product_id": "cacti-spine-1.2.13-8.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.s390x",
"product": {
"name": "cacti-spine-1.2.13-8.1.s390x",
"product_id": "cacti-spine-1.2.13-8.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-8.1.x86_64",
"product": {
"name": "cacti-spine-1.2.13-8.1.x86_64",
"product_id": "cacti-spine-1.2.13-8.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 12",
"product": {
"name": "SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:12"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-11.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-1.2.13-11.1.noarch"
},
"product_reference": "cacti-1.2.13-11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.aarch64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-8.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.ppc64le as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-8.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.s390x as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-8.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.x86_64 as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-8.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-11.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch"
},
"product_reference": "cacti-1.2.13-11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.aarch64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.ppc64le as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.s390x as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-11.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch"
},
"product_reference": "cacti-1.2.13-11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.aarch64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-8.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.ppc64le as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-8.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.s390x as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-8.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-8.1.x86_64 as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-8.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-11023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11023"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11023",
"url": "https://www.suse.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190660 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1190660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "moderate"
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 12:cacti-1.2.13-11.1.noarch",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.aarch64",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.ppc64le",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.s390x",
"SUSE Package Hub 12:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.1:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.1:cacti-spine-1.2.13-8.1.x86_64",
"openSUSE Leap 15.2:cacti-1.2.13-11.1.noarch",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.aarch64",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.ppc64le",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.s390x",
"openSUSE Leap 15.2:cacti-spine-1.2.13-8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-25T18:21:21Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
}
]
}
OPENSUSE-SU-2020:1106-1
Vulnerability from csaf_opensuse - Published: 2020-07-27 21:28 - Updated: 2020-07-27 21:28Summary
Security update for cacti, cacti-spine
Severity
Moderate
Notes
Title of the patch: Security update for cacti, cacti-spine
Description of the patch: This update for cacti, cacti-spine fixes the following issues:
- cacti 1.2.13:
* Query XSS vulnerabilities require vendor package update
(CVE-2020-11022 / CVE-2020-11023)
* Lack of escaping on some pages can lead to XSS exposure
* Update PHPMailer to 6.1.6 (CVE-2020-13625)
* SQL Injection vulnerability due to input validation failure when
editing colors (CVE-2020-14295, boo#1173090)
* Lack of escaping on template import can lead to XSS exposure
- switch from cron to systemd timers (boo#1115436):
+ cacti-cron.timer
+ cacti-cron.service
- avoid potential root escalation on systems with fs.protected_hardlinks=0
(boo#1154087): handle directory permissions in file section instead
of using chown during post installation
- rewrote apache configuration to get rid of .htaccess files and
explicitely disable directory permissions per default
(only allow a limited, well-known set of directories)
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patchnames: openSUSE-2020-1106
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.1 (Medium)
Affected products
Recommended
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.2 (High)
Affected products
Recommended
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
23 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for cacti, cacti-spine",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for cacti, cacti-spine fixes the following issues:\n\n- cacti 1.2.13:\n\n * Query XSS vulnerabilities require vendor package update\n (CVE-2020-11022 / CVE-2020-11023)\n * Lack of escaping on some pages can lead to XSS exposure\n * Update PHPMailer to 6.1.6 (CVE-2020-13625)\n * SQL Injection vulnerability due to input validation failure when\n editing colors (CVE-2020-14295, boo#1173090)\n * Lack of escaping on template import can lead to XSS exposure\n\n- switch from cron to systemd timers (boo#1115436):\n + cacti-cron.timer\n + cacti-cron.service\n- avoid potential root escalation on systems with fs.protected_hardlinks=0\n (boo#1154087): handle directory permissions in file section instead\n of using chown during post installation\n- rewrote apache configuration to get rid of .htaccess files and \n explicitely disable directory permissions per default \n (only allow a limited, well-known set of directories)\n\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1106",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1106-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1106-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4IXKYESUUIOBHBKL32YKWOWHSJKS7RN3/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1106-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4IXKYESUUIOBHBKL32YKWOWHSJKS7RN3/"
},
{
"category": "self",
"summary": "SUSE Bug 1115436",
"url": "https://bugzilla.suse.com/1115436"
},
{
"category": "self",
"summary": "SUSE Bug 1154087",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "self",
"summary": "SUSE Bug 1173090",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11023 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
}
],
"title": "Security update for cacti, cacti-spine",
"tracking": {
"current_release_date": "2020-07-27T21:28:47Z",
"generator": {
"date": "2020-07-27T21:28:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1106-1",
"initial_release_date": "2020-07-27T21:28:47Z",
"revision_history": [
{
"date": "2020-07-27T21:28:47Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.13-bp151.4.12.1.noarch",
"product": {
"name": "cacti-1.2.13-bp151.4.12.1.noarch",
"product_id": "cacti-1.2.13-bp151.4.12.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.s390x",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.s390x",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-spine-1.2.13-bp151.4.12.1.x86_64",
"product": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.x86_64",
"product_id": "cacti-spine-1.2.13-bp151.4.12.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP1",
"product": {
"name": "SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.13-bp151.4.12.1.noarch as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch"
},
"product_reference": "cacti-1.2.13-bp151.4.12.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.aarch64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.s390x as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-spine-1.2.13-bp151.4.12.1.x86_64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
},
"product_reference": "cacti-spine-1.2.13-bp151.4.12.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-11023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11023"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11023",
"url": "https://www.suse.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190660 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1190660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "moderate"
}
],
"title": "CVE-2020-11023"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:cacti-1.2.13-bp151.4.12.1.noarch",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.aarch64",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.ppc64le",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.s390x",
"SUSE Package Hub 15 SP1:cacti-spine-1.2.13-bp151.4.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-07-27T21:28:47Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
}
]
}
OPENSUSE-SU-2020:1888-1
Vulnerability from csaf_opensuse - Published: 2020-11-09 19:24 - Updated: 2020-11-09 19:24Summary
Security update for otrs
Severity
Moderate
Notes
Title of the patch: Security update for otrs
Description of the patch: This update for otrs fixes the following issues:
- otrs was updated to 6.0.30 (OSA-2020-14 boo#1178434)
- CVE-2020-11022, CVE-2020-11023: Vulnerability in third-party library - jquery
OTRS uses jquery version 3.4.1, which is vulnerable to cross-site scripting
(XSS).
Patchnames: openSUSE-2020-1888
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.1 (Medium)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
15 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for otrs",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for otrs fixes the following issues:\n\n- otrs was updated to 6.0.30 (OSA-2020-14 boo#1178434)\n - CVE-2020-11022, CVE-2020-11023: Vulnerability in third-party library - jquery\n OTRS uses jquery version 3.4.1, which is vulnerable to cross-site scripting \n (XSS).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-1888",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_1888-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:1888-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q4QSMZXUNVYKSR2VDCHWASQTIS4WW2JC/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:1888-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q4QSMZXUNVYKSR2VDCHWASQTIS4WW2JC/"
},
{
"category": "self",
"summary": "SUSE Bug 1178434",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11023 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11023/"
}
],
"title": "Security update for otrs",
"tracking": {
"current_release_date": "2020-11-09T19:24:17Z",
"generator": {
"date": "2020-11-09T19:24:17Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:1888-1",
"initial_release_date": "2020-11-09T19:24:17Z",
"revision_history": [
{
"date": "2020-11-09T19:24:17Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "otrs-6.0.30-bp152.2.11.1.noarch",
"product": {
"name": "otrs-6.0.30-bp152.2.11.1.noarch",
"product_id": "otrs-6.0.30-bp152.2.11.1.noarch"
}
},
{
"category": "product_version",
"name": "otrs-doc-6.0.30-bp152.2.11.1.noarch",
"product": {
"name": "otrs-doc-6.0.30-bp152.2.11.1.noarch",
"product_id": "otrs-doc-6.0.30-bp152.2.11.1.noarch"
}
},
{
"category": "product_version",
"name": "otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"product": {
"name": "otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"product_id": "otrs-itsm-6.0.30-bp152.2.11.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP1",
"product": {
"name": "SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1"
}
},
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP2",
"product": {
"name": "SUSE Package Hub 15 SP2",
"product_id": "SUSE Package Hub 15 SP2"
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.2",
"product": {
"name": "openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-6.0.30-bp152.2.11.1.noarch as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-doc-6.0.30-bp152.2.11.1.noarch as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-doc-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-itsm-6.0.30-bp152.2.11.1.noarch as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-6.0.30-bp152.2.11.1.noarch as component of SUSE Package Hub 15 SP2",
"product_id": "SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-doc-6.0.30-bp152.2.11.1.noarch as component of SUSE Package Hub 15 SP2",
"product_id": "SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-doc-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-itsm-6.0.30-bp152.2.11.1.noarch as component of SUSE Package Hub 15 SP2",
"product_id": "SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-6.0.30-bp152.2.11.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-doc-6.0.30-bp152.2.11.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-doc-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-itsm-6.0.30-bp152.2.11.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-6.0.30-bp152.2.11.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-doc-6.0.30-bp152.2.11.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-doc-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "otrs-itsm-6.0.30-bp152.2.11.1.noarch as component of openSUSE Leap 15.2",
"product_id": "openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
},
"product_reference": "otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-09T19:24:17Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-11023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11023"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003coption\u003e elements from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11023",
"url": "https://www.suse.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190660 for CVE-2020-11023",
"url": "https://bugzilla.suse.com/1190660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"SUSE Package Hub 15 SP2:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.1:otrs-itsm-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-doc-6.0.30-bp152.2.11.1.noarch",
"openSUSE Leap 15.2:otrs-itsm-6.0.30-bp152.2.11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-09T19:24:17Z",
"details": "moderate"
}
],
"title": "CVE-2020-11023"
}
]
}
RHBA-2025:1079
Vulnerability from csaf_redhat - Published: 2025-02-24 03:42 - Updated: 2026-06-28 12:12Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.13.4 bug fix release
Severity
Moderate
Notes
Topic: Red Hat Quay 3.13.4 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.13.4
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jQuery. HTML containing \<option\> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.
6.1 (Medium)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Moderate
References
9 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.13.4 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.13.4",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:1079",
"url": "https://access.redhat.com/errata/RHBA-2025:1079"
},
{
"category": "external",
"summary": "PROJQUAY-8577",
"url": "https://issues.redhat.com/browse/PROJQUAY-8577"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_1079.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.13.4 bug fix release",
"tracking": {
"current_release_date": "2026-06-28T12:12:57+00:00",
"generator": {
"date": "2026-06-28T12:12:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.2.6"
}
},
"id": "RHBA-2025:1079",
"initial_release_date": "2025-02-24T03:42:46+00:00",
"revision_history": [
{
"date": "2025-02-24T03:42:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-24T03:42:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-28T12:12:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"product_id": "quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"product_id": "quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.13.4-9"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.13.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"product_id": "quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.13.4-6"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"product_id": "quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"product": {
"name": "quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"product_id": "quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"product": {
"name": "quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"product_id": "quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"product_id": "quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"product": {
"name": "quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"product_id": "quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.13.4-9"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"product": {
"name": "quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"product_id": "quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.13.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le",
"product": {
"name": "quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le",
"product_id": "quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.13.4-6"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"product_id": "quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"product": {
"name": "quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"product_id": "quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"product": {
"name": "quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"product_id": "quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.13.4-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"product_id": "quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.13.4-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"product": {
"name": "quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"product_id": "quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.13.4-9"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"product": {
"name": "quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"product_id": "quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.13.4-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"product": {
"name": "quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"product_id": "quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.13.4-6"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x"
},
"product_reference": "quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le"
},
"product_reference": "quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le"
},
"product_reference": "quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x"
},
"product_reference": "quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le"
},
"product_reference": "quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x"
},
"product_reference": "quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le"
},
"product_reference": "quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x"
},
"product_reference": "quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x"
},
"product_reference": "quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le"
},
"product_reference": "quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-06-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1850004"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"8Base-Quay-3:quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "RHBZ#1850004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023"
},
{
"category": "external",
"summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/",
"url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2020-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T03:42:46+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"8Base-Quay-3:quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1079"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"8Base-Quay-3:quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0204fd4290da6989e8b28b57e99f4f92466b1f60b77b00347850f3b8c176d524_amd64",
"8Base-Quay-3:quay/clair-rhel8@sha256:1341e9d89f30bb9e12e43563078c4fb7ef1319b00958f4d22985e0cbb519d50c_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:2966a2534f8c4613495d73cd864f92c9d94ec173c57d955708f37e888fac23f6_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8c2d03c9b14aa2d9bbcffade943c94237523f52ddce814caaf6b0578aae6b1ab_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:97beaa8ac6dc90529ded16c9dcf9c3362d42efaa95d84ed50b7be9dd59a9e578_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b44cb8d8e099f31ee358f19574d54b449086ab1617c03cb41616dbd6e11994c5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:1fa7b9904402ac996d9534351e784a25f27f08fc1e089a44c85d47431f368012_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:8f3941a45070ffdf9a9d6c12588bf4c33346fb600333dddb719ee0e435210a68_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:db7c6a49d4150957f0cfb10ce3902722d7d901f41962bf4b960fb7ddf93a9a98_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:8338e1d9da6ebcfa8ac9e93709d44d2c6b3052cec3c1c316d6c50fc85a73f1cb_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:b14253a941535ea6b1a6fd060b3482f74dda955cd0afa1d86421ae6b2e1ff3d9_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d45694397744073aaeb9e79e381b3dc3c13f163adf58cc16cfddebe033db80e2_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:7f9c67dbaa841f3a96c70e020f341141f046955b575cff3f9070a45eefddf12f_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a27c1809b007085e59e8b9e15ec5fc55b5cfbdfcc23f5bba8ccf9ebd12a29562_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:c2e2addc62e0627fc82915fd59081a03773caae50c682f9169f9dcf131ae16e5_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:77a5960828a06b16f9ac13e70778b6d0b310a9087b793a05c95bd57474b77238_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:af4f196e63cc1e47a081d9f9f70f41b91983d86bdf1a4d5a0b9f2d8e573e2d5f_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:b5f8b35092db7d025a90613f3da0f7a72529181de54a08d7447bac24cb1e546d_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:44c2dd325e8f0ca3e6bc60566a573c70a7b6a086aaa7c34c059bb527e5b1d926_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:468820f558c151257ef219a0a38a21436817f6393767b22617dfc8a0f3276f7c_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:f08bbd7efc1137c3a3ff6f38488574b2a63c88f9071344eee43f5789babd2e1d_s390x",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:551ae88034a4ccd9051fd8e4c4ad26b3fc3b91a9794cd1d08bd8758eba4e7121_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:6cc8cf175183a488c50d0f2bb2aff91180d70722ea6cf39967e53092adac69ff_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:d449ed97c243dcc9fa61b8e4fa818f108017c03da9ced0520ac356eee7e669c4_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:647fcb8dd13bd96aac49f07e5535b369347665bf53a0a9491245ec2f8c531935_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:6ebb2498e2e9d70852e258739b8676d9928c68049c93318f2178eebac38b0ba5_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:7c6d2001422a4a1e76aabc0d8f71e9fbe896bcbe22c55d3c3a6d6eb738065553_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:26f0ef7faca0671bfac32eea1a1b0036df90c9c41bbf49a7efab6c633a928091_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:906688d8356f1931370d1f864b88ba53a6755a9c82de6134846907ad0bae48e4_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:c66007a0049286bdd251715f40d13ea331c6778f3a089749746be26dc7dba334_ppc64le"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2025-01-23T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods"
}
]
}
RHBA-2025:1597
Vulnerability from csaf_redhat - Published: 2025-02-24 06:54 - Updated: 2026-06-28 12:12Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.9.10 bug fix release
Severity
Moderate
Notes
Topic: Red Hat Quay 3.9.10 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.9.10
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jQuery. HTML containing \<option\> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.
6.1 (Medium)
Affected products
Fixed
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Moderate
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.9.10 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.9.10",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:1597",
"url": "https://access.redhat.com/errata/RHBA-2025:1597"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_1597.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.9.10 bug fix release",
"tracking": {
"current_release_date": "2026-06-28T12:12:55+00:00",
"generator": {
"date": "2026-06-28T12:12:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.2.6"
}
},
"id": "RHBA-2025:1597",
"initial_release_date": "2025-02-24T06:54:10+00:00",
"revision_history": [
{
"date": "2025-02-24T06:54:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-24T06:54:10+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-28T12:12:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.9.10-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.9.10-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.9.10-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.9.10-4"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"product_id": "quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.9.10-3"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.9.10-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.9.10-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"product_id": "quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.9.10-16"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.9.10-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64",
"product_id": "quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.9.10-7"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-06-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1850004"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "RHBZ#1850004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023"
},
{
"category": "external",
"summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/",
"url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2020-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-24T06:54:10+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1597"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:be5aa55fd2dac0cf68de95b4838d9d4036a74498b0105e51700de04ea927178d_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:2e29f557653b8b39d560ad20d04fa3059a82a8e7a91a38759abbf0ad5e407277_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:98579eac921a1f826a0076bce00630df914bc828846cb266871330fb84465026_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:4516ea12db56b25d13631446b6d6cbd9f8feac7e4aff6eb25ac0e360e3a4fa01_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:e7a5ff90f004faeeda52d504f7d4396e2952f5b0021c69d5176e189b25eafec0_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:367ea9ce8fd4214c1c88d4954501aed7573ab5d6c914815a5f16c65d14f95636_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:65b1b3bd0d998b41a80b47d4ec4b2f78dea39e1e68d06c110ac39103f5f09984_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:923b0084f2f6c0c8e097c12fd0b381314b1f2f407ab77a49b97d837c88c8d641_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:4305f51c514c95b6a03b5f6390c624dfed6fed361d6e7b0e6f270912e6aeb7c8_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:222815636c389658b5692de815033013bc6cd7760a169eff664b2caabf44ec24_amd64"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2025-01-23T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…