2 lines
3.6 KiB
JSON
2 lines
3.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PI Connector for CygNet","vendor":"AVEVA","versions":[{"lessThanOrEqual":"1.6.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site scripting vulnerability exists in \nAVEVA PI Connector for CygNet \nVersions 1.6.14 and prior that, if exploited, could allow an \nadministrator miscreant with local access to the connector admin portal \nto persist arbitrary JavaScript code that will be executed by other \nusers who visit affected pages."},{"lang":"es","value":"Existe una vulnerabilidad de cross-site scripting en AVEVA PI Connector para CygNet versiones 1.6.14 y anteriores que, de ser explotada, podría permitir que un administrador malintencionado con acceso local al portal de administración del conector guarde código JavaScript arbitrario que será ejecutado por otros usuarios que visiten las páginas afectadas."}],"id":"CVE-2025-4417","lastModified":"2026-06-17T09:33:12.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.1,"impactScore":4.0,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4417","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-06-12T19:56:09.240198Z","version":"2.0.3"}}]},"published":"2025-06-12T20:15:21.760","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://www.aveva.com/en/support-and-success/cyber-security-updates/"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
|