A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.

A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the software’s web application to redirect to the chosen domain after a successful login is performed.

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Power Monitoring Expert (PME) product, EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediation provided below may risk a Cross Site Scripting or an open redirect attack which could result in an account takeover scenario or the execution of code in the user browser