{"id":"CVE-2023-29022","state":"PUBLISHED","title":"Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack","description":"\nA cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product \n\nthat could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.\n\n\n\n","publishedAt":"2023-05-11T17:51:33.822Z","updatedAt":"2025-01-24T16:15:52.659Z","severity":{"score":4.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation ArmorStart ST"],"affected":[{"vendor":"Rockwell Automation","product":"ArmorStart ST","defaultStatus":"unaffected","versions":[{"version":"All ","status":"affected"}]}],"references":["https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/29xxx/CVE-2023-29022.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-29022","state":"PUBLISHED","datePublished":"2023-05-11T17:51:33.822Z","dateUpdated":"2025-01-24T16:15:52.659Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2023-03-29T20:07:06.685Z"},"containers":{"cna":{"title":"Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack","descriptions":[{"lang":"en","value":"\nA cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product \n\nthat could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page.\n\n\n\n"}],"affected":[{"vendor":"Rockwell Automation","product":"ArmorStart ST","defaultStatus":"unaffected","versions":[{"version":"All ","status":"affected"}]}],"references":[{"url":"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2023-05-11T17:51:33.822Z"},"datePublic":"2023-05-11T14:00:00.000Z","impacts":[{"capecId":"CAPEC-63","descriptions":[{"lang":"en","value":"CAPEC-63 Cross-Site Scripting (XSS)"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Customers should disable the webserver during normal use. The webserver is disabled by default and should only be enabled to modify configurations. After modifying configurations, the web server should be disabled."}],"value":"Customers should disable the webserver during normal use. The webserver is disabled by default and should only be enabled to modify configurations. After modifying configurations, the web server should be disabled."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1139438","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T14:00:14.779Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-01-24T16:15:01.660455Z","id":"CVE-2023-29022","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-24T16:15:52.659Z"}}]}}}