CVE-2021-29661: XSS
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diagvalues.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-29661.
What is the title of this vulnerability?
The title of this vulnerability is 'Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTV...'.
What is the severity rating of CVE-2021-29661?
The severity rating of CVE-2021-29661 is medium (5.4).
How does CVE-2021-29661 work?
CVE-2021-29661 allows for Stored XSS through the ITEMLISTVALUES##ITEMID parameter, enabling injection of a JavaScript payload into the trace file.
How can I mitigate the risk of CVE-2021-29661?
To mitigate the risk of CVE-2021-29661, it is recommended to update Softing AG OPC Toolbox to version 4.10.1.13035 or later.