Microchip TimePictra Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Microchip TimePictra web application, affecting versions 11.0 through 11.3 SP2. The issue arises from improper input validation of the network element name parameter, allowing attackers to execute scripts that are stored and potentially executed in the context of other users.

Impact

Exploitation of this vulnerability could enable an attacker to collect application information, such as session IDs, from users who view the compromised data.

Remediation

It is recommended to control access to the web application. Microchip plans to address this vulnerability in a future release.