VulnerabilityModified
CVE-2011-4035
Cross-site scripting (XSS) vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified…
MEDIUM 4.3EPSS 2.00%
Does this matter?
Lower severity and a low EPSS score (2.00%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.00% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- schneider-electric/vijeo historian · schneider-electric/citecthistorian · schneider-electric/citectscada reports
- Source
- cret@cert.org
References
- http://www.citect.com/index.php?option=com_content&view=article&id=1656&Itemid=1695
- http://www.scada.schneider-electric.com/sites/scada/en/login/historian-vulnerability.page
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-307-01.pdfUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71503
- http://www.citect.com/index.php?option=com_content&view=article&id=1656&Itemid=1695
- http://www.scada.schneider-electric.com/sites/scada/en/login/historian-vulnerability.page
- http://www.us-cert.gov/control_systems/pdf/ICSA-11-307-01.pdfUS Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71503
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.