{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-5880", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2023-10-31T13:56:12.783Z", "datePublished": "2024-01-03T19:16:44.618Z", "dateUpdated": "2024-01-03T19:16:44.618Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["RTOS"], "product": "Aladdin Connect (Retrofit-Kit)", "vendor": "The Genie Company", "versions": [{"lessThanOrEqual": "<=14.1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<br><b>When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers \u201cGarage Door Control Module Setup\u201d page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious&nbsp;code with client side Java Script and/or HTML into the users' web browser.&nbsp;</b><br>"}], "value": "When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers \u201cGarage Door Control Module Setup\u201d page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious\u00a0code with client side Java Script and/or HTML into the users' web browser.\u00a0\n"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2024-01-03T19:16:44.618Z"}, "references": [{"url": "https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "title": "Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:geniecompany:aladdin_connect_garage_door_opener_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA29F57E-D2DF-4DCB-8280-741EBC06C1AF", "versionEndIncluding": "14.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:geniecompany:aladdin_connect_garage_door_opener:-:*:*:*:*:*:*:*", "matchCriteriaId": "666249EC-DBBC-48AD-80B3-FC124536B03D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers \u201cGarage Door Control Module Setup\u201d page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious\u00a0code with client side Java Script and/or HTML into the users' web browser.\u00a0\n"}, {"lang": "es", "value": "Cuando The Genie Company Aladdin Connect garage door opener(modelo ALDCM del kit de actualizaci\u00f3n) se coloca en modo de configuraci\u00f3n, la p\u00e1gina \"Garage Door Control Module Setup\" del servidor web es vulnerable a XSS a trav\u00e9s de un nombre SSID de transmisi\u00f3n que contiene c\u00f3digo malicioso con Java Script del lado del cliente y /o HTML. Esto permite al atacante inyectar c\u00f3digo malicioso con Java Script y/o HTML del lado del cliente en el navegador web de los usuarios."}], "id": "CVE-2023-5880", "lastModified": "2024-01-11T18:26:04.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.3, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-03T20:15:21.833", "references": [{"source": "cve@rapid7.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.rapid7.com/blog/post/2024/01/03/genie-aladdin-connect-retrofit-garage-door-opener-multiple-vulnerabilities/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}