CVE-2021-23285: Security issues in Eaton Intelligent Power Manager Infrastructure
First published: Mon Apr 18 2022(Updated: )
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0plus205 and prior versions.
Credit: CybersecurityCOE@eaton.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eaton Intelligent Power Manager | <=1.5.0plus205 |
Remedy
The product has reached its End Of Life, the notification has been posted at: Lifecycle Notification: The transition to IPM Monitor Edition is in progress. Refer the Product page for further details.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Manager-(IPM)-Infrastructure-Vulnerability-Advisory_1001c_V1.0.pdf
- https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/power-management-software-connectivity/eaton-intelligent-power-manager/software/ipm-understand-edition-emea/eaton-ipminfra-eolmemo-en-us.pdf.
- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Manager-%28IPM%29-Infrastructure-Vulnerability-Advisory_1001c_V1.0.pdf
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-23285.
What is the severity of CVE-2021-23285?
The severity of CVE-2021-23285 is medium with a CVSS score of 4.8.
What is the affected software?
The affected software is Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions.
What is the impact of this vulnerability?
This vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, potentially leading to unauthorized access or data theft.
How can I fix CVE-2021-23285?
To fix CVE-2021-23285, it is recommended to upgrade to a patched version of Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/title
- agent/event
- vendor/eaton
- canonical/eaton intelligent power manager
- version/eaton intelligent power manager/1.5.0plus205