Vulnerability · Published Nov 30, 2023 · Assigned by SEL
CVE-2023-2266Improper neutralization of input during web page generation could lead to cross-site scripting based attacks
Medium 4.3
In plain English
A medium-severity cross-site scripting in SEL-411L from Schweitzer Engineering Laboratories. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An Improper neutralization of input during web page generation in the Schweitzer Engineering Laboratories SEL-411L could allow an attacker to generate cross-site scripting based attacks against an authorized and authenticated user. See product Instruction Manual Appendix A dated 20230830 for more details.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schweitzer Engineering Laboratories | SEL-411L | R118-V0 – before R118-V4R119-V0 – before R119-V5R120-V0 – before R120-V6R121-V0 – before R121-V3R122-V0 – before R122-V3R123-V0 – before R123-V3R124-V0 – before R124-V3R125-V0 – before R125-V3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N