A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate their privileges by exploiting a stored cross-site scripting (XSS) vulnerability in the switch group function under /#ilang=DE&b=c_smartenergy_swgroups in the web portal. The vulnerability can be exploited to gain the rights of an installer or PM, which can then be used to gain administrative access to the web portal and execute further attacks. NOTE: The vendor states that this vulnerability has been fixed in version 6.2.0-170.
Metrics
Affected Vendors & Products
References
History
Wed, 18 Sep 2024 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate their privileges by exploiting a stored cross-site scripting (XSS) vulnerability in the switch group function under /#ilang=DE&b=c_smartenergy_swgroups in the web portal. The vulnerability can be exploited to gain the rights of an installer or PM, which can then be used to gain administrative access to the web portal and execute further attacks. | A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate their privileges by exploiting a stored cross-site scripting (XSS) vulnerability in the switch group function under /#ilang=DE&b=c_smartenergy_swgroups in the web portal. The vulnerability can be exploited to gain the rights of an installer or PM, which can then be used to gain administrative access to the web portal and execute further attacks. NOTE: The vendor states that this vulnerability has been fixed in version 6.2.0-170. |
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2024-02-02T00:00:00
Updated: 2024-09-18T19:02:28.180380
Reserved: 2023-10-23T00:00:00
Link: CVE-2023-46344
Vulnrichment
No data.
NVD
Status : Modified
Published: 2024-02-02T02:15:16.537
Modified: 2024-09-18T19:15:38.530
Link: CVE-2023-46344
Redhat
No data.