CVEvulnerability

CVE-2015-6462

5.4 MEDIUM Published 2019-03-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.

Affected configurations

• schneider-electric bmxnoc0401 firmware • schneider-electric bmxnoe0100 firmware • schneider-electric bmxnoe0110 firmware • schneider-electric bmxnoe0110h firmware • schneider-electric bmxnor0200h firmware • schneider-electric modicon m340 bmxp342020 firmware • schneider-electric modicon m340 bmxp342020h firmware • schneider-electric modicon m340 bmxp342030 firmware • schneider-electric modicon m340 bmxp3420302 firmware • schneider-electric modicon m340 bmxp3420302h firmware • schneider-electric modicon m340 bmxp342030h firmware

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References