Log in Start free

Vulnerability · Published May 10, 2023 · Assigned by SEL

CVE-2023-31159Improper Neutralization of Input During Web Page Generation

Medium 4.3

In plain English

A medium-severity cross-site scripting in SEL-2241 RTAC module from Schweitzer Engineering Laboratories. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 61.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL Service Bulletin dated 2022-11-15 for more details.

Affected products (as reported)

VendorProductVersions
Schweitzer Engineering Laboratories SEL-3505 R132-V0 – before R150-V2R132-V0 – before R149-V4R132-V0 – before R148-V7R132-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3505-3 R132-V0 – before R150-V2R132-V0 – before R149-V4R132-V0 – before R148-V7R132-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3530 R132-V0 – before R150-V2R132-V0 – before R149-V4R132-V0 – before R148-V7R132-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3530-4 R132-V0 – before R150-V2R132-V0 – before R149-V4R132-V0 – before R148-V7R132-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3532 R132-V0 – before R150-V2R132-V0 – before R149-V4R132-V0 – before R148-V7R132-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3555 R134-V0 – before R150-V2R134-V0 – before R149-V4R134-V0 – before R148-V7R134-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3560S R144-V2 – before R150-V2R144-V2 – before R149-V4R144-V2 – before R148-V7R144-V2 – before R147-V6
Schweitzer Engineering Laboratories SEL-3560E R144-V2 – before R150-V2R144-V2 – before R149-V4R144-V2 – before R148-V7R144-V2 – before R147-V6
Schweitzer Engineering Laboratories SEL-2241 RTAC module R132-V0 – before R150-V2R132-V0 – before R149-V4R132-V0 – before R148-V7R132-V0 – before R147-V6
Schweitzer Engineering Laboratories SEL-3350 R148-V0 – before R150-V2R148-V0 – before R149-V4R148-V0 – before R148-V7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

References