CVE-2023-46282

published 2023-12-12

CVE-2023-46282: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…

medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All versions < V4.1), SINEC NMS (All versions < V2.0 SP1), Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15.1 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions < V17 Update 8), Totally Integrated Automation Portal (TIA Portal) V18 (All versions < V18 Update 3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected applications that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
siemens	opcenter_execution_foundation	< V2407	V2407
siemens	opcenter_quality	< V2312	V2312
siemens	simatic_pcs_neo	< V4.1	V4.1
siemens	simatic_pcs_neo	< 4.1	4.1
siemens	sinec_nms	< V2.0 SP1	V2.0 SP1
siemens	totally_integrated_automation_portal	—	—
siemens	totally_integrated_automation_portal	>= 14.0 < 15	15
siemens	totally_integrated_automation_portal	>= 15 < 16	16
siemens	totally_integrated_automation_portal	>= 16 < 17	17
siemens	totally_integrated_automation_portal	>= 17 < 18	18
siemens	totally_integrated_automation_portal_v14	< *	*
siemens	totally_integrated_automation_portal_v15.1	< *	*
siemens	totally_integrated_automation_portal_v16	< *	*
siemens	totally_integrated_automation_portal_v17	< V17 Update 8	V17 Update 8
siemens	totally_integrated_automation_portal_v18	< V18 Update 3	V18 Update 3

CWE-79