title: Elcomplus SmartICS Cross-site Scripting
description: Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
problem types: CWE-79: Cross-site Scripting
affected:
{
product: SmartICS
vendor: Elcomplus
versions:
status: affected, version: v2.3.4.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Elcomplus has released Version 2.4 to address these vulnerabilities and recommends users update to the newest version. Users can obtain the new version on request on the official SmartICS website https://smartics.io/