CVE-2019-19393

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or a hijacked session.

• CWE-79

• https://github.com/miguelhamal/CVE-2019-19393Third Party Advisory
• https://www.rittal.us/monitoring-security/cmc-iii.htmlBroken Link, Vendor Advisory
• https://github.com/miguelhamal/CVE-2019-19393Third Party Advisory
• https://www.rittal.us/monitoring-security/cmc-iii.htmlBroken Link, Vendor Advisory

Published

Oct 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19388A cross-site scripting (XSS) vulnerability in app/dialplans/…6.1
• CVE-2019-19389JetBrains Ktor framework before version 1.2.6 was vulnerable…5.4
• CVE-2019-1939A vulnerability in the Cisco Webex Teams client for Windows …8.8
• CVE-2019-19390The Search parameter of the Software Catalogue section of Ma…5.4
• CVE-2019-19391In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and…9.1
• CVE-2019-19392The forDNN.UsersExportImport module before 1.2.0 for DNN (fo…9.8
• CVE-2019-19394Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and …6.1
• CVE-2019-19396illumos, as used in OmniOS Community Edition before r151030y…7.5
• CVE-2019-19397There is a weak algorithm vulnerability in some Huawei produ…7.5
• CVE-2019-19398M5 lite 10 with versions of 8.0.0.182(C00) have an insuffici…9.8
• CVE-2019-1940A vulnerability in the Web Services Management Agent (WSMA) …5.9
• CVE-2019-1941A vulnerability in the web-based management interface of Cis…6.1