PT-2021-22122
CVE-2021-38428
·
تاريخ النشر
2021-11-03
·
تاريخ التحديث
2021-11-05
الوصف من
CVSS 3.1
5.5
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Delta Electronics DIALink versions 1.2.4.0 and prior
Description
The issue allows an authenticated attacker to inject arbitrary JavaScript code into the
name parameter of the "API schedule" endpoint, which may enable remote code execution.Recommendations
For Delta Electronics DIALink versions 1.2.4.0 and prior, consider restricting access to the API schedule endpoint until a patch is available. As a temporary workaround, avoid using the
name parameter in the affected API endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾