Subnet Solutions Inc. PowerSYSTEM Center
Successful exploitation of these vulnerabilities could result in an attacker bypassing a proxy, creating a denial-of-service condition, or viewing sensitive information.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-45857US | medium6.5 | Exploit | ||
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any… | ||||
| CVE-2021-3749US | high7.5 | Exploit | ||
axios is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2020-28168US | medium5.9 | — | ||
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-277-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-277-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (6)
- MitigationPowerSYSTEM Center
For all vulnerabilities, users can disable usage of previous UI extensions.
- MitigationPowerSYSTEM Center
For all vulnerabilities, users can disable usage of previous UI extensions.
- MitigationPowerSYSTEM Center
For all vulnerabilities, users can disable usage of previous UI extensions.
- FixedPowerSYSTEM Center
For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.
- FixedPowerSYSTEM Center
For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.
- FixedPowerSYSTEM Center
For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center Client Access Server user's ability to access the browser's F12 Developer Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN, and to manipulate requests to the PowerSYSTEM Center website.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan