CVE-2022-40183 - OpenCVE

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user.

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Bosch	Videojet Multi 4000 Videojet Multi 4000 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:bosch:videojet_multi_4000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:bosch:videojet_multi_4000:-:*:*:*:*:*:*:*

References

Link	Resource
https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html	Patch Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: bosch

Published: 2022-10-27T00:00:00

Updated: 2022-10-27T00:00:00

Reserved: 2022-09-08T00:00:00

Link: CVE-2022-40183

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-10-27T17:15:10.430

Modified: 2022-10-31T13:48:22.260

Link: CVE-2022-40183

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:bosch:videojet_multi_4000_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "821A0ADF-1601-4688-B3E6-636748D48EE8", "versionEndIncluding": "6.31.0010", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:bosch:videojet_multi_4000:-:*:*:*:*:*:*:*", "matchCriteriaId": "19868F38-8A56-451C-AE74-FEADA0FDD6EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user."}, {"lang": "es", "value": "Un error en el controlador de URL de VIDEOJET multi 4000 puede provocar un Cross Site Scripting (XSS) reflejado en la interfaz basado en web. Un atacante con conocimiento de la direcci\u00f3n del codificador puede enviar un enlace manipulando a un usuario, que ejecutar\u00e1 c\u00f3digo JavaScript en el contexto del usuario."}], "id": "CVE-2022-40183", "lastModified": "2022-10-31T13:48:22.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.7, "source": "psirt@bosch.com", "type": "Secondary"}]}, "published": "2022-10-27T17:15:10.430", "references": [{"source": "psirt@bosch.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html"}], "sourceIdentifier": "psirt@bosch.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@bosch.com", "type": "Secondary"}]}