CVE-2023-31177 - CVE House

Back to Database

Status published Medium CVE-2023-31177

Improper neutralizataion of input could lead to execution of arbitrary code

4.3 CVSS

Vulnerability Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system. See product Instruction Manual Appendix A dated 20230830 for more details.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-31177

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Andrea Palanca and Gabriele Quagliarella of Nozomi Networks

References

More from Schweitzer Engineering Laboratories

View All →

Deserialization of Untrusted Data

Improper Limitation of a Pathname to a Restricted Directory

Improper Control of Interaction Frequency

Observable Response Discrepancy

Improper Restriction of Excessive Authentication Attempts

Affected Vendor

Schweitzer Engineering Laboratories

View all reports →

Affected Software

SEL-451

Vulnerable Versions:

R315-V0, R316-V0, R317-V0, R318-V0, R320-V0, R321-V0, R322-V0, R323-V0, R324-V0, R325-V0, R326-V0, R327-V0

Timeline

Official Publish: November 30th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement