title: Security issues in Intelligent Power Manager (IPM 1)
description: The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Intelligent Power Manager (IPM 1)
vendor: Eaton
versions:
lessThan: 1.70, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
version: 3.1
]
solutions: Eaton has patched these security issues and new versions of the affected software are released. The latest versions can be downloaded from below location: -
Eaton IPM v1.70 – https://www.eaton.com/us/en-us/digital/brightlayer/brightlayer-data-centers-suite/disaster-avoidance-software.html