CVE-2021-23282

Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of input from certain resources by the IPM software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 4.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Manager-Vulnerability-Advisory_1001a_V1.0.pdf

Configurations

No configuration.

History

No history.

Information

Published : 2024-11-25 09:15

Updated : 2026-06-17 03:38

NVD link : CVE-2021-23282

Mitre link : CVE-2021-23282

CVE.ORG link : CVE-2021-23282

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-23282", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2021-23282", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-25T13:57:47.686743Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "CybersecurityCOE@eaton.com", "affectedData": [{"vendor": "Eaton", "product": "Intelligent Power Manager (IPM)", "versions": [{"status": "affected", "version": "0", "lessThan": "1.70", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2024-11-25T09:15:04.350", "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/Eaton-Intelligent-Power-Manager-Vulnerability-Advisory_1001a_V1.0.pdf", "source": "CybersecurityCOE@eaton.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The\nvulnerability exists due to insufficient validation of input from certain resources by the IPM software.\nThe attacker would need access to the local Subnet and an administrator interaction to compromise\nthe system"}, {"lang": "es", "value": "Eaton Intelligent Power Manager (IPM) anterior a la versi\u00f3n 1.70 es vulnerable a ataques de cross-site scripting almacenado. La vulnerabilidad existe debido a una validaci\u00f3n insuficiente de la entrada de ciertos recursos por parte del software IPM. El atacante necesitar\u00eda acceso a la subred local y una interacci\u00f3n con el administrador para comprometer el sistema."}], "lastModified": "2026-06-17T03:38:32.850", "sourceIdentifier": "CybersecurityCOE@eaton.com"}