Advantech WebAccess HMI/SCADA CVE-2013-2299 Cross Site Scripting Vulnerability

Bugtraq ID:	57227
Class:	Input Validation Error
CVE:	CVE-2013-2299
Remote:	Yes
Local:	No
Published:	Jan 09 2013 12:00AM
Updated:	Aug 14 2013 06:06AM
Credit:	Antu Sanadi of SecPod Technologies
Vulnerable:
Not Vulnerable:

Advantech WebAccess HMI/SCADA CVE-2013-2299 Cross Site Scripting Vulnerability

Advantech WebAccess HMI/SCADA is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advantech WebAccess HMI/SCADA 7.0 and prior are vulnerable.

Advantech WebAccess HMI/SCADA CVE-2013-2299 Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.

Advantech WebAccess HMI/SCADA CVE-2013-2299 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Advantech WebAccess HMI/SCADA CVE-2013-2299 Cross Site Scripting Vulnerability

References: