CVE-2023-41781 - OpenCVE

There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Zte	Mf258 Firmware Mf258

Configuration 1 [-]

AND

OR	cpe:2.3:o:zte:mf258_firmware:zte_std_v1.0.0b08:::::::*
	cpe:2.3:o:zte:mf258_firmware:zte_std_v1.0.0b10:::::::*

cpe:2.3:h:zte:mf258:-:*:*:*:*:*:*:*

References

Link	Resource
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034684	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: zte

Published: 2024-01-10T06:11:49.198Z

Updated: 2024-01-10T06:12:27.758Z

Reserved: 2023-09-01T09:02:00.657Z

Link: CVE-2023-41781

JSON object: View

NVD Information

Status : Analyzed

Published: 2024-01-10T07:15:49.423

Modified: 2024-01-17T01:24:19.650

Link: CVE-2023-41781

JSON object: View

Redhat Information

No data.

CWE

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-41781", "assignerOrgId": "6786b568-6808-4982-b61f-398b0d9679eb", "state": "PUBLISHED", "assignerShortName": "zte", "dateReserved": "2023-09-01T09:02:00.657Z", "datePublished": "2024-01-10T06:11:49.198Z", "dateUpdated": "2024-01-10T06:12:27.758Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MF258", "vendor": "ZTE", "versions": [{"lessThanOrEqual": "ZTE_STD_V1.0.0B10", "status": "affected", "version": "ZTE_STD_V1.0.0B08", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nThere is a Cross-site scripting (XSS)  vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.\n\n"}], "value": "\nThere is a Cross-site\u00a0scripting (XSS) \u00a0vulnerability in ZTE MF258. Due to insufficient input validation of\u00a0SMS\u00a0interface parameter, an XSS attack will be triggered.\n\n"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6786b568-6808-4982-b61f-398b0d9679eb", "shortName": "zte", "dateUpdated": "2024-01-10T06:12:27.758Z"}, "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034684"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">ZTE_STD_V1.0.0B11</span>\n\n<br>"}], "value": "\nZTE_STD_V1.0.0B11\n\n\n"}], "source": {"discovery": "EXTERNAL"}, "title": "XSS Vulnerability in ZTE MF258 Products", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf258_firmware:zte_std_v1.0.0b08:*:*:*:*:*:*:*", "matchCriteriaId": "D421170F-6499-46F3-B1E9-9366AD2E15C8", "vulnerable": true}, {"criteria": "cpe:2.3:o:zte:mf258_firmware:zte_std_v1.0.0b10:*:*:*:*:*:*:*", "matchCriteriaId": "947AC795-92ED-461B-9F8F-1CE3CBDCB27B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf258:-:*:*:*:*:*:*:*", "matchCriteriaId": "3D637B37-F21F-418F-9B21-9E2920AC372B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "\nThere is a Cross-site\u00a0scripting (XSS) \u00a0vulnerability in ZTE MF258. Due to insufficient input validation of\u00a0SMS\u00a0interface parameter, an XSS attack will be triggered.\n\n"}, {"lang": "es", "value": "Hay una vulnerabilidad de Cross-Site Scripting (XSS) en ZTE MF258. Debido a una validaci\u00f3n de entrada insuficiente del par\u00e1metro de la interfaz SMS, se desencadenar\u00e1 un ataque XSS."}], "id": "CVE-2023-41781", "lastModified": "2024-01-17T01:24:19.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.7, "source": "psirt@zte.com.cn", "type": "Secondary"}]}, "published": "2024-01-10T07:15:49.423", "references": [{"source": "psirt@zte.com.cn", "tags": ["Vendor Advisory"], "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034684"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@zte.com.cn", "type": "Secondary"}]}