Vulnerability · Published Jun 1, 2023 · Assigned by jpcert
CVE-2023-28651
Medium 4.8
In plain English
A medium-severity cross-site scripting in CONPROSYS HMI System (CHS) from Contec Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 62.4% (higher than 99.2% of all known vulnerabilities).
Official description
Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contec Co., Ltd. | CONPROSYS HMI System (CHS) | versions prior to 3.5.3 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N