CVE-2019-13931 Cross-site scripting in XHQ
An authenticated attacker can inject malicious scripts into the Siemens XHQ web interface, allowing them to modify application content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-13931?
CVE-2019-13931 is a medium-severity cross-site scripting vulnerability in Siemens AG XHQ, published on 12 Dec 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow for an an attacker to craft the input in a form that is not expected, causing the application to behave in unexpected ways for legitimate users. Successful exploitation requires for an attacker to be authenticated to the web interface. A successful attack could cause the application to have unexpected behavior. This could allow the attacker to modify contents of the web application. At the time of advisory publication no public exploitation of this security vulnerability was known.
Which versions are affected by CVE-2019-13931?
It affects 1 product.
Products include Siemens Xhq.
How do I fix CVE-2019-13931?
No fix has been published for CVE-2019-13931 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-13931 being exploited?
There is no known exploitation of CVE-2019-13931 in the wild and no public exploit code.
Other vulnerabilities in Siemens AG XHQ
Sources
Also known as GHSA-h7c9-gjhc-27w5.