Sign-up

ID

VAR-202308-0477


CVE

CVE-2023-38121


TITLE

Inductive Automation  of  Ignition  Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-028345

DESCRIPTION

Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the id parameter provided to the Inductive Automation Ignition web interface. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20355. (DoS) It may be in a state. Inductive Automation Ignition‌ is a comprehensive platform for industrial automation that provides scalable solutions for monitoring, control, data collection, and analysis

Trust: 2.79

sources: NVD: CVE-2023-38121 // JVNDB: JVNDB-2023-028345 // ZDI: ZDI-23-1012 // CNVD: CNVD-2024-48763

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-48763

AFFECTED PRODUCTS

vendor:inductive automationmodel:ignitionscope: - version: -

Trust: 1.5

vendor:inductiveautomationmodel:ignitionscope:ltversion:8.1.26

Trust: 1.0

vendor:inductive automationmodel:ignitionscope:eqversion: -

Trust: 0.8

vendor:inductive automationmodel:ignitionscope:eqversion:8.1.26

Trust: 0.8

vendor:inductivemodel:automation ignitionscope:eqversion:8.1.24

Trust: 0.6

sources: ZDI: ZDI-23-1012 // CNVD: CNVD-2024-48763 // JVNDB: JVNDB-2023-028345 // NVD: CVE-2023-38121

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-38121
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-38121
value: CRITICAL

Trust: 1.0

NVD: CVE-2023-38121
value: CRITICAL

Trust: 0.8

ZDI: CVE-2023-38121
value: HIGH

Trust: 0.7

CNVD: CNVD-2024-48763
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-48763
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2023-38121
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 6.0
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2023-38121
baseSeverity: CRITICAL
baseScore: 9.0
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.3
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2023-38121
baseSeverity: CRITICAL
baseScore: 9.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-38121
baseSeverity: HIGH
baseScore: 8.3
vectorString: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 6.0
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1012 // CNVD: CNVD-2024-48763 // JVNDB: JVNDB-2023-028345 // NVD: CVE-2023-38121 // NVD: CVE-2023-38121

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [ others ]

Trust: 0.8

problemtype: Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-028345 // NVD: CVE-2023-38121

PATCH

title:Inductive Automation has issued an update to correct this vulnerability.url:https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Trust: 0.7

title:Patch for Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/644271

Trust: 0.6

sources: ZDI: ZDI-23-1012 // CNVD: CNVD-2024-48763

EXTERNAL IDS

db:NVDid:CVE-2023-38121

Trust: 3.9

db:ZDIid:ZDI-23-1012

Trust: 3.1

db:JVNDBid:JVNDB-2023-028345

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-20355

Trust: 0.7

db:CNVDid:CNVD-2024-48763

Trust: 0.6

sources: ZDI: ZDI-23-1012 // CNVD: CNVD-2024-48763 // JVNDB: JVNDB-2023-028345 // NVD: CVE-2023-38121

REFERENCES

url:https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Trust: 2.5

url:https://www.zerodayinitiative.com/advisories/zdi-23-1012/

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2023-38121

Trust: 0.8

sources: ZDI: ZDI-23-1012 // CNVD: CNVD-2024-48763 // JVNDB: JVNDB-2023-028345 // NVD: CVE-2023-38121

CREDITS

20urdjk

Trust: 0.7

sources: ZDI: ZDI-23-1012

SOURCES

db:ZDIid:ZDI-23-1012
db:CNVDid:CNVD-2024-48763
db:JVNDBid:JVNDB-2023-028345
db:NVDid:CVE-2023-38121

LAST UPDATE DATE

2025-03-14T22:53:25.889000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1012date:2023-08-01T00:00:00
db:CNVDid:CNVD-2024-48763date:2024-12-20T00:00:00
db:JVNDBid:JVNDB-2023-028345date:2025-03-13T02:07:00
db:NVDid:CVE-2023-38121date:2025-03-12T14:32:50.177

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1012date:2023-08-01T00:00:00
db:CNVDid:CNVD-2024-48763date:2023-08-03T00:00:00
db:JVNDBid:JVNDB-2023-028345date:2025-03-13T00:00:00
db:NVDid:CVE-2023-38121date:2024-05-03T02:15:56.377