{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system.\n\nUpdate: 27.02.2024 Fix typo in advisory title", "title": "Summary" }, { "category": "description", "text": "The vulnerabilities allow an attacker to inject malicious Javascript code into the system. With PASvisu\nBuilder in a worst-case scenario this can lead to execution of arbitrary code using the privileges of the\nuser running the affected software. With PASvisu Runtime (including PMI v8xx) in a worst-case\nscenario this could have an impact on the controlled automation application.", "title": "Impact" }, { "category": "description", "text": " * Only use project files from trustworthy sources.\n * Protect project files against modification by unauthorized users.\n * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar\nmeasures. Use password protection on the online project.", "title": "Mitigation" }, { "category": "description", "text": "Install the fixed product version as soon as it is available. Please visit the Pilz eShop\n(https://www.pilz.com/en-INT/eshop external link) to check for the fixed version", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "security@pilz.com", "name": "Pilz GmbH & Co. KG", "namespace": "https://www.pilz.com" }, "references": [ { "category": "external", "summary": "PILZ PSIRT", "url": "https://www.pilz.com/de-DE/company/news/articles/200605" }, { "category": "external", "summary": "CERT@VDE Security Advisories for PILZ products", "url": "https://certvde.com/en/advisories/vendor/pilz/" }, { "category": "self", "summary": "VDE-2023-050: Pilz: Vulnerability in PASvisu and PMI v8xx - HTML", "url": "https://certvde.com/en/advisories/VDE-2023-050/" }, { "summary": "VDE-2023-050: Pilz: Vulnerability in PASvisu and PMI v8xx - CSAF", "url": "https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2024/vde-2023-050.json", "category": "self" } ], "title": "Pilz: Vulnerability in PASvisu and PMI v8xx", "tracking": { "aliases": [ "VDE-2023-050" ], "current_release_date": "2025-04-10T13:00:00.000Z", "generator": { "date": "2024-06-10T06:39:45.830Z", "engine": { "name": "Secvisogram", "version": "2.5.4" } }, "id": "VDE-2023-050", "initial_release_date": "2024-01-30T07:00:00.000Z", "revision_history": [ { "date": "2024-01-30T07:00:00.000Z", "number": "1", "summary": "Initial revision." }, { "date": "2024-02-27T14:00:00.000Z", "number": "2", "summary": "Updated Title." }, { "date": "2024-11-06T11:27:01.000Z", "number": "3", "summary": "Fix: correct certvde domain, added self-reference" }, { "date": "2025-04-10T13:00:00.000Z", "number": "4", "summary": "fixed version operators" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "PMI v8xx", "product": { "name": "PILZ Hardware PMI v8xx", "product_id": "CSAFPID-1101", "product_identification_helper": { "model_numbers": [ "266807", "266812", "266815" ] } } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "<1.14.1", "product": { "name": "PILZ Software PASvisu <1.14.1", "product_id": "CSAFPID-5101" } }, { "category": "product_version", "name": "1.14.1", "product": { "name": "PILZ Software PASvisu 1.14.1", "product_id": "CSAFPID-5201" } } ], "category": "product_name", "name": "PASvisu" } ], "category": "product_family", "name": "Software" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "<=2.0.33992", "product": { "name": "PILZ Firmware PMI v8xx <=2.0.33992", "product_id": "CSAFPID-2101" } } ], "category": "product_name", "name": "PMI v8xx" } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "PILZ" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-3101", "CSAFPID-5101" ], "summary": "Affected products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "PILZ Firmware PMI v8xx <=2.0.33992 installed on PILZ Hardware PMI v8xx", "product_id": "CSAFPID-3101" }, "product_reference": "CSAFPID-2101", "relates_to_product_reference": "CSAFPID-1101" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-45795", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "audience": "all", "category": "description", "text": "A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-3101", "CSAFPID-5101" ] }, "remediations": [ { "category": "mitigation", "details": " * Only use project files from trustworthy sources.\n * Protect project files against modification by unauthorized users.\n * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar\nmeasures. Use password protection on the online project.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": " Install the fixed product version as soon as it is available. Please visit the Pilz eShop\n(https://www.pilz.com/en-INT/eshop external link) to check for the fixed version", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-3101", "CSAFPID-5101" ] } ], "title": "CVE-2023-45795" }, { "cve": "CVE-2023-45796", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "audience": "all", "category": "description", "text": "A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity and/or availability.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-3101", "CSAFPID-5101" ] }, "remediations": [ { "category": "mitigation", "details": " * Only use project files from trustworthy sources.\n * Protect project files against modification by unauthorized users.\n * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar\nmeasures. Use password protection on the online project.", "group_ids": [ "CSAFGID-0001" ] }, { "category": "vendor_fix", "details": " Install the fixed product version as soon as it is available. Please visit the Pilz eShop\n(https://www.pilz.com/en-INT/eshop external link) to check for the fixed version", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-3101", "CSAFPID-5101" ] } ], "title": "CVE-2023-45796" } ] }