Summary
Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system.
Update: 27.02.2024 Fix typo in advisory title
Details
Impact
The vulnerabilities allow an attacker to inject malicious Javascript code into the system. With PASvisu
Builder in a worst-case scenario this can lead to execution of arbitrary code using the privileges of the
user running the affected software. With PASvisu Runtime (including PMI v8xx) in a worst-case
scenario this could have an impact on the controlled automation application.
Mitigation
* Only use project files from trustworthy sources.
* Protect project files against modification by unauthorized users.
* PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar
measures. Use password protection on the online project.
Remediation
Install the fixed product version as soon as it is available. Please visit the Pilz eShop
(https://www.pilz.com/en-INT/eshop external link) to check for the fixed version
Vulnerabilities 2
-
High 8.1
XSS vulnerability in Pilz PASvisu and PMI v8xx
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity…
-
High 7.8
Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.
Revision history
-
#4
fixed version operators
-
#3
Fix: correct certvde domain, added self-reference
-
#2
Updated Title.
-
#1
Initial revision.
References
-
PILZ PSIRT
https://www.pilz.com/de-DE/company/news/articles/200605
-
CERT@VDE Security Advisories for PILZ products
https://certvde.com/en/advisories/vendor/pilz/
-
VDE-2023-050: Pilz: Vulnerability in PASvisu and PMI v8xx - HTML
https://certvde.com/en/advisories/VDE-2023-050/