title: Real Time Automation 460 Series Cross-site Scripting
description:
Real Time Automation 460 Series products with versions prior to v8.9.8 are vulnerable to cross-site scripting, which could allow an attacker to run any JavaScript reference from the URL string. If this were to occur, the gateway's HTTP interface would redirect to the main page, which is index.htm.
problem types: CWE-79 Cross-site Scripting
affected:
{
defaultStatus: unaffected
product: 460 Series
vendor: Real Time Automation
versions:
lessThan: v8.9.8, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Real Time Automation recommends users download and apply the new version of their product. To update the software, contact Real Time Automation directly for assistance.