E3 Site Supervisor Control Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in E3 Site Supervisor Control versions prior to 2.31F01. The issue arises from a floor plan feature that allows unauthenticated attackers to upload floor plan files. By crafting a specific type of floor plan file, an attacker can inject malicious scripts that are stored and executed on the floor plan web page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the floor plan page.