Description
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Schneider Electric EcoStruxure Power Monitoring Expert (PME) 2021
Default version status: unaffected
2021 CU1 and prioraffected
Schneider Electric EcoStruxure Power Monitoring Expert (PME) 2020
Default version status: unaffected
2020 CU3 and prioraffected
Schneider Electric EcoStruxure Power Operation (EPO) 2022
Default version status: unaffected
CU4 and prioraffected
Schneider Electric EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module
Default version status: unaffected
CU4 and prioraffected
Schneider Electric EcoStruxure Power Operation (EPO) 2021
Default version status: unaffected
CU4 and prioraffected
Schneider Electric EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module
Default version status: unaffected
CU3 with Hotfix 2 and prioraffected
Schneider Electric EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module
Default version status: unaffected
All Versionsaffected