Description
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists on a DCE file upload endpoint when tampering with parameters
over HTTP.
Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | StruxureWare Data Center Expert | All – ≤ V7.9.2 | — |
Advisories 1
- SEVD-2023-045-02 StruxureWare Data Center Expert Schneider Electric CPCERT · Feb 14, 2023