Published: 22/10/2021 Updated: 28/11/2021

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.

Vulnerable Product	Search on Vulmon	Subscribe to Product
automatedlogic webctrl

WebCTRL OEM version 65 suffers from a cross site scripting vulnerability ...

WebCTRL Reflected XSS Vulnerability in the locale GET Parameter

WebCTRL-OperatorLocale-Parameter-Reflected-XSS WebCTRL Reflected XSS Vulnerability in the operatorlocale GET Parameter A reflected XSS vulnerability exists in the WebCTRL/WebCTRL OEM Login page that allows for JavaScript code execution via a not sanitized GET parameter CVE-2021-31682

CWE-79 https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html https://nvd.nist.gov https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS https://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-31682

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect