CVE-2021-23283
Assigner: Eaton
Published: 2022-03-01T00:00:00
State: PUBLISHED
affected: product: Eaton Intelligent Power Protector (IPP)
vendor: Eaton
versions: lessThan: 1.69 release 166
status: affected
version: unspecified
versionType: custom
credits: value: Eaton thanks the below organization and individuals for their coordinated support on the security vulnerability: CVE-2021-23283 - Micheal Heinzl via ICS-Cert
datePublic: 2022-03-01T00:00:00
descriptions: value: Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
solutions: value: Eaton has patched the security issue and new version of the affected software has been released. The latest version can be downloaded from below location: - Eaton IPP v1.69 https://www.eaton.com/us/en-us/products/backup-power-ups-surge-it-power-distribution/software-downloads.html
source: discovery: UNKNOWN
title: Security issues in Eaton Intelligent Power Protector (IPP)
x_generator: engine: Vulnogram 0.0.9