Strix
26.1K

CVE-2023-2746

CRITICALCVSS 9.6/10EPSS 0.40%

Last modified

CVE-2023-2746 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). EPSS estimates a 0.40% chance of exploitation in the next 30 days.

Description

The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products.

Metrics

CVSS 3.1
9.6/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Probability
0.40%

31.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
RockwellautomationEnhanced Him1.001

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-2746?
The Rockwell Automation Enhanced HIM software contains an API that the application uses that is not protected sufficiently and uses incorrect Cross-Origin Resource Sharing (CORS) settings and, as a result, is vulnerable to a Cross Site Request Forgery (CSRF) attack. To exploit this vulnerability, a malicious user would have to convince a user to click on an untrusted link through a social engineering attack or successfully perform a Cross Site Scripting Attack (XSS). Exploitation of a CSRF could potentially lead to sensitive information disclosure and full remote access to the affected products.
How severe is CVE-2023-2746?
CVE-2023-2746 has a CVSS score of 9.6/10 (CRITICAL severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.
How do I fix CVE-2023-2746?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-2746?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST