CVEvulnerability

CVE-2018-18985

5.4 MEDIUM Published 2019-01-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-01-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.

Affected configurations

• tridium niagara (< 4.4.93.40.2) • tridium niagara (>= 4.6 < 4.6.96.28.4) • tridium niagara 4.4u2 • tridium niagara ax framework (< 3.8.401.1) • tridium niagara ax framework 3.8u4 • tridium niagara enterprise security (< 2.3.118.6) • tridium niagara enterprise security 2.3u1

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References