CyberRota Analysis
AI-GeneratedThe vulnerability affects the ScadaLTS 2.8.1-release-candidate build 0, allowing authenticated low-privilege users to execute arbitrary JavaScript code through the "validateScript" method in the DWR "DataSourceEditDwr" class, which lacks proper authorization checks. This could lead to remote code execution, potentially compromising the integrity and confidentiality of the system. Organizations using this version of ScadaLTS should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.