title: Phoenix Contact: FL MGUARD XSS through web-based management and REST API
description: In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: FL MGUARD
vendor: PHOENIX CONTACT
versions:
lessThan: FL MGUARD 1102 (No. 1153079)*, status: affected, version: 1.4.0, versionType: custom
lessThan: FL MGUARD 1105 (No. 1153078)*, status: affected, version: 1.4.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
solutions: PHOENIX CONTACT recomments to upgrade to firmware version 1.5.1 (or any later version).
workarounds: If an untrusted user may have exploited the vulnerability, it is recommended to revoke access for that user, and to re-upload the certificates on the Basic settings > LDAP and Logs > Remote logging pages through the REST API (i.e., without viewing these pages in the web-based management).