Skip to content
OpenAdvisories
Medium VDE-2023-027 1 CVE

AUMA: Reflected Cross-Site Scripting Vulnerability in SIMA Master Stations

Published Aug 7, 2023 · Updated Aug 7, 2023

Vendor: Auma Product: SIMA² Master Station

Summary

A reflected cross-site scripting vulnerability exists in the System Diagnostics Manager (SDM) component of SIMA² Master Stations.

Details

Impact
Please consult the CVE details.

Mitigation
Do not use Hyperlinks provided by untrusted 3rd party to access the SIMA² System Diagnostics Manager. Hyperlinks may be provided via:

- Emails from unknown users
- Social media channels
- Messaging services
- Webpages with comment functionality
- QR Codes

The use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.

Vulnerabilities 1

  • Medium 6.1
    CVE-2022-4286

    Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime

    A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.

    B&R Industrial Automation B&R Automation Runtime

Revision history

  1. #1.0.0

    Initial revision.

References