Rockwell Automation FactoryTalk DataMosaix Private Cloud Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in Rockwell Automation's FactoryTalk DataMosaix Private Cloud. This issue allows for the execution of malicious JavaScript, potentially leading to account takeover, credential theft, or redirection to harmful websites. The vulnerability affects versions 7.11, 8.00, and 8.01, and arises from improper encoding or escaping of output.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to version 8.01 to address this vulnerability. For those unable to upgrade, Rockwell Automation recommends following their security best practices.