Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance
Advisory ansehen veröffentlicht 2023-08-29
A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account (i.e., with the "Teacher" role), to craft a malicious course and launch an XSS attack.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-23414US | medium6.1 | — | ||
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- FSA-202301: Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance - HTMLself
- CERT@VDE Security Advisories for Festo SE & Co. KGexternal
- For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)external
- FSA-202301: Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance - CSAFself
03
Behebungen (1)
- BehobenLX Appliance
Contact Festo Didactic services department at services.didactic@festo.com to update your LX Appliance to the latest version.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan