CVE-2018-18985 Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all ve...
MediumCVSS 5.4
EPSS 0.97%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Tridium niagara | < 4.4.93.40.2 | 4.4.93.40.2 |
| Tridium niagara | >= 4.6, < 4.6.96.28.4 | 4.6.96.28.4 |
| Tridium niagara | = 4.4u2 | No fix listed |
| Tridium niagara ax framework | < 3.8.401.1 | 3.8.401.1 |
| Tridium niagara ax framework | = 3.8u4 | No fix listed |
| Tridium Niagara Enterprise Security | < 2.3.118.6 | 2.3.118.6 |
| Tridium Niagara Enterprise Security | = 2.3u1 | No fix listed |
| Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 | = Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4. | No fix listed |
References
- 106530 third-party-advisory vdb-entry
- ics-cert.us-cert.gov third-party-advisory us-government-resource