Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-48193: SYT-2022-11: Multiple vulnerabilities in smartLink SW-HT

Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).

CVE
#xss#vulnerability#web#java#ssl

Publisher: Softing Industrial Automation GmbH

Document category: csaf_security_advisory

Initial release date: 2022-12-29T11:00:00.000Z

Engine: Secvisogram 2.0.0

Current release date: 2023-03-27T10:00:00.000Z

Build Date: 2023-03-27T10:00:00.000Z

Current version: 2.0.0

Status: final

CVSSv3.1 Base Score: 7.2

Severity: high

Original language: en-US

Language:

Also referred to:

Vulnerabilities****2022-17 (CVE-2022-48192)****2022-17

Cross-site Scripting, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the context of the application.

CWE:

CWE-83:Improper Neutralization of Script in Attributes in a Web Page

Discovery date:

2022-09-02T10:00:00.000Z

Product status****Known affected

Product

CVSS-Vector

CVSS Base Score

Softing smartLink SW-HT <= V1.20

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2

Fixed

  • Softing smartLink SW-HT V1.30

Acknowledgments

  • Anthony Goyette from from Chevron

2022-18 (CVE-2022-48193)****2022-18

Weak ciphers are enabled during secure communication (SSL).

CWE:

CWE-326:Inadequate Encryption Strength

Discovery date:

2022-11-29T11:00:00.000Z

Product status****Known affected

Product

CVSS-Vector

CVSS Base Score

Softing smartLink SW-HT <= V1.20

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.9

Fixed

  • Softing smartLink SW-HT V1.30

Acknowledgments

  • Anthony Goyette from from Chevron

Softing Industrial Automation GmbH

Namespace: https://industrial.softing.com

Softing PSIRT - contact us at [email protected]

Revision history

Version

Date of the revision

Summary of the revision

1.0.0

2022-12-29T11:00:00.000Z

Initial version

2.0.0

2023-03-27T10:00:00.000Z

Update with smartLink SW-HT V1.30

Disclaimer

The information provided in this disclosure is provided “as is” without warranty of any kind. Softing disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Softing or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Softing or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907