Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance
view advisory published 2023-08-29
A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account (i.e., with the "Teacher" role), to craft a malicious course and launch an XSS attack.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-23414US | medium6.1 | — | ||
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code. | ||||
02
references
External citations — patches, advisories, analysis.
- FSA-202301: Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance - HTMLself
- CERT@VDE Security Advisories for Festo SE & Co. KGexternal
- For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)external
- FSA-202301: Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance - CSAFself
03
remediations (1)
- FixedLX Appliance
Contact Festo Didactic services department at services.didactic@festo.com to update your LX Appliance to the latest version.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan