Vulnerability · Published Jan 28, 2025 · Assigned by schneider
CVE-2024-8401
Medium 5.4
In plain English
A medium-severity cross-site scripting in EcoStruxure Power Monitoring Expert (PME) 2020 from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure Power Monitoring Expert (PME) 2021 | 2021 CU1 and prior |
| Schneider Electric | EcoStruxure Power Monitoring Expert (PME) 2020 | 2020 CU3 and prior |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2022 | CU4 and prior |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module | CU4 and prior |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2021 | CU4 and prior |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module | CU3 with Hotfix 2 and prior |
| Schneider Electric | EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module | All Versions |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N