HTTP: Delta Industrial Automation DIALink Stored Cross-Site Scripting
This signature detects attempts to exploit a known cross-site scripting vulnerability against Delta Industrial Automation DIALink. It is due to insufficient validation of user-supplied input. Attackers can steal cookie-based authentication credentials and launch other attacks.
Extended Description
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.
Affected Products
Deltaww dialink
References
CVE: CVE-2021-38488
Short Name
HTTP:XSS:DELTA-IA-DIALINK
Severity
Warning
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Automation CVE-2021-38428 CVE-2021-38488 Cross-Site DIALink Delta Industrial Scripting Stored
Release Date
03/03/2022
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3693
False Positive
Unknown
Vendors
Deltaww
CVSS Score
3.5