Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frangoteam | FUXA | = 1.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fuxa-server | >= 1.3.0, < 1.3.1 | 1.3.1 | GHSA-fwcm-rqvw-j3p7 |