CVE-2019-19393

Katalog CVE

CVSS 6.1 · Medium EPSS 0,85%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada rittal cmc pu iii 7030.000 firmware. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or a hijacked session.

Rincian

Terbit di NVD

1 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 56,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.rittal.us/monitoring-security/cmc-iii.html broken link · advisory vendor
• https://github.com/miguelhamal/CVE-2019-19393 advisory pihak ketiga