CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability
OpenPLC ScadaBR contains a cross-site scripting vulnerability via systemsettings.shtm.
Other sources
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via systemsettings.shtm.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
OpenPLC / ScadaBRfrom your environment.Discontinue use of the product if mitigations are unavailable (uninstall or remove instances of OpenPLC / ScadaBR when you cannot apply effective mitigations).
- Compensating control
Follow applicable BOD 22-01 guidance for cloud services to mitigate exposure of affected OpenPLC / ScadaBR instances.
- Operational
Identify and inventory all OpenPLC / ScadaBR instances. Pay particular attention to instances running versions through 0.9.1 on Linux and through 1.12.4 on Windows, which are vulnerable to stored XSS via system_settings.shtm.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26829?
CVE-2021-26829 has a medium severity rating due to its potential to allow stored cross-site scripting (XSS) attacks.
How do I fix CVE-2021-26829?
To fix CVE-2021-26829, update OpenPLC ScadaBR to a version beyond 0.9.1 on Linux or beyond 1.12.4 on Windows.
What impacts does CVE-2021-26829 have on my system?
CVE-2021-26829 can lead to unauthorized access and execution of malicious scripts, impacting the integrity and security of your application.
Which versions are affected by CVE-2021-26829?
CVE-2021-26829 affects OpenPLC ScadaBR versions up to and including 0.9.1 on Linux and 1.12.4 on Windows.
Is CVE-2021-26829 related to web application security?
Yes, CVE-2021-26829 is directly related to web application security due to its cross-site scripting vulnerability.