« Volver al listado

CVE-2017-16721

Estado: ModificadaMedia (6.1)—

A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Geovap — Reliance-scada

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-16721",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Geovap Reliance SCADA",
          "versions": [
            {
              "status": "affected",
              "version": "Geovap Reliance SCADA"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-12-04T15:29:00.193",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/102031",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-334-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.securityfocus.com/bid/102031",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-334-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema de Cross-Site Scripting (XSS) en Geovap Reliance SCADA versión 4.7.3 Update 2 y anteriores. Esta vulnerabilidad podría permitir que un atacante no autenticado inyecte código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T01:09:42.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59F8B332-8519-4857-A26D-57A68E71332A",
              "versionEndIncluding": "4.7.1"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:4.7.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8845136F-890E-45EF-8B17-A10A4605015F"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:4.7.2:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CF4AE3A-F7AE-4539-B172-0C83A85BCEA8"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:4.7.2:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F68BF20-73E7-4039-96B7-2F4EE27A0CC4"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:4.7.3:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE9B5E7B-3638-4FB6-B683-99196CC62300"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:4.7.3:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8D85376-A73F-441E-8DB8-7AF4B4AE1E49"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance-scada:4.7.3:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE781807-FE39-4B87-AF0A-EAE951B016A3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}