B&R APROL Web Portal Improper Input Neutralization Vulnerability Allowing Code Injection

A vulnerability allowing improper neutralization of input during web page generation has been identified in the APROL Web Portal, specifically in B&R APROL versions prior to 4.4-00P5. This vulnerability may enable an authenticated network-based attacker to inject malicious code that is executed within the context of the user's browser session.

Impact

Exploitation of this vulnerability could lead to code injection, allowing the injected code to be executed in the context of the user's browser session.

Remediation

Users are advised to upgrade to B&R APROL version 4.4-01 or version 4.4-00P5 or later. After applying the update, it is recommended to change all passwords and secrets, as some vulnerabilities may have compromised credential confidentiality.