CVE-2021-23228: Delta Electronics DIAEnergie (Update A)
Published Dec 22, 2021
·Updated
DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”.
Affected Software
2 affected componentsFixes available
Delta Electronics DIAEnergie<1.9
1.9
Deltaww Diaenergie<=1.7.5
Remediation
Information
Delta Electronics has released an updated version of DIAEnergie and recommends users install v1.8.0 and later on all affected systems.
Event History
Dec 22, 2021
CVE Published
via MITRE·06:06 PM
Data Sourced
via MITRE·06:06 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2021-23228?
CVE-2021-23228 is a vulnerability in DIAEnergie version 1.7.5 and prior that allows for a reflected cross-site scripting attack through error pages returned by '.NET Request.QueryString'.
2
How severe is CVE-2021-23228?
CVE-2021-23228 has a severity rating of 6.1 (high).
3
Which software versions are affected by CVE-2021-23228?
DIAEnergie version 1.7.5 and prior are affected by CVE-2021-23228.
4
How can I fix CVE-2021-23228?
To fix CVE-2021-23228, it is recommended to upgrade to a version of DIAEnergie that is not affected by the vulnerability.
5
Where can I find more information about CVE-2021-23228?
More information about CVE-2021-23228 can be found at the following link: [https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03]