Description
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
vulnerability exists when an authenticated attacker modifies folder names within the context of
the product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure Power Monitoring Expert (PME) 2021 | 2021 CU1 and prior | — |
| Schneider Electric | EcoStruxure Power Monitoring Expert (PME) 2020 | 2020 CU3 and prior | — |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2022 | CU4 and prior | — |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module | CU4 and prior | — |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2021 | CU4 and prior | — |
| Schneider Electric | EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module | CU3 with Hotfix 2 and prior | — |
| Schneider Electric | EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module | All Versions | — |
Advisories 2
- ICSA-25-014-03 Schneider Electric EcoStruxure CISA ICS & IT advisories · Sep 10, 2024
- SEVD-2024-254-02 EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards Schneider Electric CPCERT · Sep 10, 2024