Pilz: Vulnerability in PASvisu and PMI v8xx
Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. Update: 27.02.2024 Fix typo in advisory title
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-45796US | — | — | ||
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthe… | ||||
| CVE-2023-45795US | — | — | ||
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full con… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Mitigation
* Only use project files from trustworthy sources. * Protect project files against modification by unauthorized users. * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar measures. Use password protection on the online project.
- Mitigation
* Only use project files from trustworthy sources. * Protect project files against modification by unauthorized users. * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar measures. Use password protection on the online project.
- Fixed
Install the fixed product version as soon as it is available. Please visit the Pilz eShop (https://www.pilz.com/en-INT/eshop external link) to check for the fixed version
- Fixed
Install the fixed product version as soon as it is available. Please visit the Pilz eShop (https://www.pilz.com/en-INT/eshop external link) to check for the fixed version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan