XSS in Ge Workstationst
CVE-2022-37952
A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (25.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Ge Workstationst
- Ge Gas Power Workstationst — versions unspecified
Weakness classification (CWE)
References
- GEPowerCVD@ge.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-37952?
- CVE-2022-37952 is a medium-severity vulnerability in Ge Workstationst, classified under Cross-site Scripting. CVSS score: 4.7/10. Published 2022-08-25.
- How severe is CVE-2022-37952?
- Medium severity. CVSS v3 base score is 4.7 out of 10.