CVE-2021-23283: Security issues in Eaton Intelligent Power Protector (IPP)

Q: What is the vulnerability of CVE-2021-23283?

CVE-2021-23283 is a stored Cross Site Scripting vulnerability in Eaton Intelligent Power Protector (IPP) prior to version 1.69.

Q: How does CVE-2021-23283 occur?

CVE-2021-23283 occurs due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.

Q: What is the severity of CVE-2021-23283?

The severity of CVE-2021-23283 is medium with a CVSS score of 5.4.

Q: Which software versions are affected by CVE-2021-23283?

Eaton Intelligent Power Protector versions prior to 1.69 are affected by CVE-2021-23283.

Q: How can I fix CVE-2021-23283?

To fix CVE-2021-23283, update Eaton Intelligent Power Protector to version 1.69 or higher.

Published Apr 19, 2022

Updated

Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.

Affected Software

1 affected component

Eaton Intelligent Power Protector<1.69

Remediation

Patch Available

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Protector-Vulnerability-Advisory_1001b_V1.0.pdf

Information

Eaton has patched the security issue and new version of the affected software has been released. The latest version can be downloaded from below location: - Eaton IPP v1.69 https://www.eaton.com/us/en-us/products/backup-power-ups-surge-it-power-distribution/software-downloads.html

Event History

Apr 19, 2022

CVE Published

via MITRE·08:26 PM

Data Sourced

via MITRE·08:26 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability of CVE-2021-23283?