CVE-2017-14850

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-03 · updated 2026-06-17
Weakness: CWE-79

Description

All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external user-input validation. An attacker with access to the web interface is able to hijack sessions or navigate victims outside of SiteOmat, to a malicious server owned by him.

Affected products

Orpak Siteomat: before 6.4.414.084 — fixed in 6.4.414.084

How to fix

Upgrade to a fixed version: Orpak Siteomat 6.4.414.084. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/108167
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
https://www.orpak.com
http://www.securityfocus.com/bid/108167
https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
https://www.orpak.com

Get alerted when CVE-2017-14850 or the next vulnerability affects your stack