CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2022-22804

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)

Exploit prediction scoring system (EPSS) score

EPSS Score 0.005

EPSS Ranking 65.1%

CVSS Severity

CVSS v3 Score 5.4

CVSS v2 Score 3.5

References

Products affected by CVE-2022-22804

Schneider-Electric » Ecostruxure Power Monitoring Expert » Version: 2020

cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:2020
Schneider-Electric » Ecostruxure Power Monitoring Expert » Version: 7.0

cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:7.0
Schneider-Electric » Ecostruxure Power Monitoring Expert » Version: 8.0

cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.0
Schneider-Electric » Ecostruxure Power Monitoring Expert » Version: 8.2

cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:8.2
Schneider-Electric » Ecostruxure Power Monitoring Expert » Version: 9.0

cpe:2.3:a:schneider-electric:ecostruxure_power_monitoring_expert:9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2022-22804

Products

Pricing

Contact Us