Date	Type	Platform	Author	EDB-ID	CVE-ID	OSVDB-ID	Download	App	SIS Signature
2017-11-30	Other	Geovap	Can Demirel of Biznet Bilisim reported the vulnerability to ICS-CERT.	N/A	CVE-2017-1672	N/A		N/A	N/A

Source

						
							
								
#
# Geovap Reliance SCADA
#


### VULNERABLE VENDOR
Geovap


### VULNERABLE PRODUCT
Reliance SCADA 


### RESEARCHER
Can Demirel of Biznet Bilisim reported the vulnerability to ICS-CERT.


### AFFECTED PRODUCTS
The following versions of Reliance SCADA, a software management platform, are affected:

Reliance SCADA Version 4.7.3 Update 2 and prior


### IMPACT
Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject arbitrary JavaScript in a specially crafted URL request that may allow for read/write access.


### VULNERABILITY OVERVIEW
IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
This vulnerability could allow an unauthenticated attacker to inject arbitrary code.
CVE-2017-16721 has been assigned to this vulnerability.
A CVSS v3 base score of 6.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)





### BACKGROUND
Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems, and Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Czech Republic




### MITIGATION

Geovap has released Version 4.7.3 Update 3 of the software which can be found at:

https://www.reliance-scada.com/en/download