Lucene search

SELCVE-2023-2266

HistoryNov 30, 2023 - 5:15 p.m.

CVE-2023-2266

2023-11-3017:15:08

CWE-79

SEL

web.nvd.nist.gov

cve-2023-2266

sel-411l

web page generation

cross-site scripting

security vulnerability

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

An Improper neutralization of input during web page generation in the Schweitzer Engineering Laboratories SEL-411L could allow an attacker to generate cross-site scripting based attacks against an authorized and authenticated user.

See product Instruction Manual Appendix A dated 20230830 for more details.

Affected configurations

Nvd

Node

selincsel-411lMatch-

AND

selincsel-411l_firmwareRanger118-v0–r118-v4

selincsel-411l_firmwareRanger119-v0–r119-v5

selincsel-411l_firmwareRanger120-v0–r120-v6

selincsel-411l_firmwareRanger121-v0–r121-v3

selincsel-411l_firmwareRanger122-v0–r122-v3

selincsel-411l_firmwareRanger123-v0–r123-v3

selincsel-411l_firmwareRanger124-v0–r124-v3

selincsel-411l_firmwareRanger125-v0–r125-v3

selincsel-411l_firmwareRanger126-v0–r126-v4

selincsel-411l_firmwareRanger127-v0–r127-v2

selincsel-411l_firmwareMatchr128-v0

selincsel-411l_firmwareMatchr129-v0

VendorProductVersionCPE
selincsel-411l-cpe:2.3:h:selinc:sel-411l:-:*:*:*:*:*:*:*
selincsel-411l_firmware*cpe:2.3:o:selinc:sel-411l_firmware:*:*:*:*:*:*:*:*
selincsel-411l_firmwarer128-v0cpe:2.3:o:selinc:sel-411l_firmware:r128-v0:*:*:*:*:*:*:*
selincsel-411l_firmwarer129-v0cpe:2.3:o:selinc:sel-411l_firmware:r129-v0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
selinc	sel-411l	-	cpe:2.3:h:selinc:sel-411l:-:::::::*
selinc	sel-411l_firmware	*	cpe:2.3:o:selinc:sel-411l_firmware::::::::
selinc	sel-411l_firmware	r128-v0	cpe:2.3:o:selinc:sel-411l_firmware:r128-v0:::::::*
selinc	sel-411l_firmware	r129-v0	cpe:2.3:o:selinc:sel-411l_firmware:r129-v0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SEL-411L",
    "vendor": "Schweitzer Engineering Laboratories",
    "versions": [
      {
        "lessThan": "R118-V4",
        "status": "affected",
        "version": "R118-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R119-V5",
        "status": "affected",
        "version": "R119-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R120-V6",
        "status": "affected",
        "version": "R120-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R121-V3",
        "status": "affected",
        "version": "R121-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R122-V3",
        "status": "affected",
        "version": "R122-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R123-V3",
        "status": "affected",
        "version": "R123-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R124-V3",
        "status": "affected",
        "version": "R124-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R125-V3",
        "status": "affected",
        "version": "R125-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R126-V4",
        "status": "affected",
        "version": "R126-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R127-V2",
        "status": "affected",
        "version": "R127-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R128-V1",
        "status": "affected",
        "version": "R128-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R129-V1",
        "status": "affected",
        "version": "R129-V0",
        "versionType": "custom"
      }
    ]
  }
]

References

selinc.com/support/security-notifications/external-reports/

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-2266