What’s Vulnerable › Vulnerabilities

CVE-2022-37952: WorkstationST - Reflected XSS in iHistorian Data Display Tags

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-25 · updated 2026-06-17
• Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.

Affected products

• GE Gas Power WorkstationST: before 07.09.15 — fixed in 07.09.15

How to fix

Upgrade to a fixed version: GE Gas Power WorkstationST 07.09.15. Check the vendor advisory for mitigations.

References

• https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Reflected_XSS.pdf
• https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Reflected_XSS.pdf

Get alerted when CVE-2022-37952 or the next vulnerability affects your stack