Lucene search

SELCVE-2023-31177

HistoryNov 30, 2023 - 5:15 p.m.

CVE-2023-31177

2023-11-3017:15:08

CWE-79

SEL

web.nvd.nist.gov

cve-2023-31177

cross-site scripting

sel-451

schweitzer engineering laboratories

input neutralization

web page generation

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

19.8%

JSON

An Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim’s system.

See product Instruction Manual Appendix A dated 20230830 for more details.

Affected configurations

Nvd

Node

selincsel-451_firmwareRanger315-v0–r315-v4

selincsel-451_firmwareRanger316-v0–r316-v4

selincsel-451_firmwareRanger317-v0–r317-v4

selincsel-451_firmwareRanger318-v0–r318-v5

selincsel-451_firmwareRanger320-v0–r320-v3

selincsel-451_firmwareRanger321-v0–r321-v3

selincsel-451_firmwareRanger322-v0–r322-v3

selincsel-451_firmwareRanger323-v0–r323-v5

selincsel-451_firmwareRanger324-v0–r324-v4

selincsel-451_firmwareRanger325-v0–r325-v3

selincsel-451_firmwareMatchr326-v0

selincsel-451_firmwareMatchr327-v0

AND

selincsel-451Match-

VendorProductVersionCPE
selincsel-451_firmware*cpe:2.3:o:selinc:sel-451_firmware:*:*:*:*:*:*:*:*
selincsel-451_firmwarer326-v0cpe:2.3:o:selinc:sel-451_firmware:r326-v0:*:*:*:*:*:*:*
selincsel-451_firmwarer327-v0cpe:2.3:o:selinc:sel-451_firmware:r327-v0:*:*:*:*:*:*:*
selincsel-451-cpe:2.3:h:selinc:sel-451:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
selinc	sel-451_firmware	*	cpe:2.3:o:selinc:sel-451_firmware::::::::
selinc	sel-451_firmware	r326-v0	cpe:2.3:o:selinc:sel-451_firmware:r326-v0:::::::*
selinc	sel-451_firmware	r327-v0	cpe:2.3:o:selinc:sel-451_firmware:r327-v0:::::::*
selinc	sel-451	-	cpe:2.3:h:selinc:sel-451:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SEL-451",
    "vendor": "Schweitzer Engineering Laboratories",
    "versions": [
      {
        "lessThan": "R315-V4",
        "status": "affected",
        "version": "R315-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R316-V4",
        "status": "affected",
        "version": "R316-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R317-V4",
        "status": "affected",
        "version": "R317-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R318-V5",
        "status": "affected",
        "version": "R318-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R320-V3",
        "status": "affected",
        "version": "R320-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R321-V3",
        "status": "affected",
        "version": "R321-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R322-V3",
        "status": "affected",
        "version": "R322-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R323-V5",
        "status": "affected",
        "version": "R323-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R324-V4",
        "status": "affected",
        "version": "R324-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R325-V3",
        "status": "affected",
        "version": "R325-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R326-V1",
        "status": "affected",
        "version": "R326-V0",
        "versionType": "custom"
      },
      {
        "lessThan": "R327-V1",
        "status": "affected",
        "version": "R327-V0",
        "versionType": "custom"
      }
    ]
  }
]

References

selinc.com/support/security-notifications/external-reports/

www.nozominetworks.com/blog/

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

19.8%

JSON

Related for CVE-2023-31177