Description
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHOENIX CONTACT | FL MGUARD | 1.4.0 – < FL MGUARD 1102 (No. 1153079)*, 1.4.0 – < FL MGUARD 1105 (No. 1153078)* | FL MGUARD 1102 (No. 1153079)* |
Advisories 1
- VDE-2021-046 PHOENIX CONTACT: XSS and memory-leak in FL MGUARD 1102/1105 CERT@VDE · Nov 10, 2021