CVE-2023-5987: schneider electric ecostruxure power monitoring expert (pme) Cross-site Scripting
Vulnerability summary
CVE-2023-5987 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in schneider electric ecostruxure power monitoring expert (pme). EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.6% of scored vulnerabilities.
Timeline
- 15-11-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Schneider electric3 products
- ecostruxure power monitoring expert (pme)Version 2020 CU2 and prior | Version 2021 CU1 and prior
- ecostruxure power operation (epo) – advanced reporting and dashboards moduleAdvanced Reporting and Dashboards Module 2021 prior to CU2 for EcoStruxure Power Operation 2021 | Advanced Reporting and Dashboards Module 2020 prior to CU3
- ecostruxure power scada operation (pso) - advanced reporting and dashboards moduleEcoStruxure Power SCADA Operation (PSO) 2020 or 2020 R2
Schneider-electric1 product
- ecostruxure_power_monitoring_expert2020 | 2020:cumulative_update_1 | 2020:cumulative_update_2 | 2021 | 2021:cumulative_update_1
2 vendors · 4 products