CVE:CVE-2019-10933
CNNVD:CNNVD-201907-537
Siemens Spectrum Power是德国西门子（Siemens）公司的一套能源管理系统。
Siemens Spectrum Power中存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。以下产品及版本受到影响：Siemens Spectrum Power 3（Corporate User Interface）v3.11及之前版本、Siemens Spectrum Power 4（Corporate User Interface）v4.75版本、Siemens Spectrum Power 5（Corporate User Interface）v5.50及之前版本、Siemens Spectrum Power 7（Corporate User Interface）v2.20及之前版本。
solution:Upgrade siemens spectrum_power_3 to a higher version than 3.11,and avoid the version (,3.11]; Upgrade siemens spectrum_power_4 to a higher version than 4.75,and avoid the version (,4.75]; Upgrade siemens spectrum_power_5 to a higher version than 5.50,and avoid the version (,5.50]; Upgrade siemens spectrum_power_7 to a higher version than 2.20,and avoid the version (,2.20]