CVE-2014-5397

High

Published: 28/08/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

The XSS vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors.

Risk Assessment

Attackers can exploit this vulnerability to perform cross-site scripting attacks, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to upgrade to the latest version of the software to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 to 5.5

See all

CVE-2014-5399High
CVE-2014-5399 is an SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 that allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-2380High
Schneider Electric Wonderware Information Server (WIS) Portal versions 4.0 SP1 through 5.5 uses weak encryption, allowing remote attackers to obtain sensitive information by reading a credential file.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.