CVE-2023-25553 MEDIUM

CVE-2023-25553

Vendor Schneider Electric
Product StruxureWare Data Center Expert
Weakness CWE-79 · XSS
Published April 18, 2023
Last update February 5, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint through the logging capabilities of the webserver. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)

Key dates

02Disclosure timeline

April 18, 2023 CVE published
February 5, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-52503 WordPress Tailored Tools plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-4780 Image Hover Effects – Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter CVE-2026-44903 Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI CVE-2022-2646 SourceCodester Online Admission System index.php cross site scripting CVE-2024-50546 WordPress MyOrderDesk plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability