CVE-2023-29030

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290317.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290328.1An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation CVE-2023-29047.3The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the appl CVE-2023-290436.1Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed w CVE-2023-290445.4Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation CVE-2023-290455.4Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be CVE-2023-290464.3Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connectio CVE-2023-290477.3Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrar CVE-2023-290488.8A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged run CVE-2023-290496.1The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised CVE-2023-29058.8Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an CVE-2023-290509.6The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside