CVE-2022-40183

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html	Patch Vendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bosch:videojet_multi_4000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:bosch:videojet_multi_4000:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:21

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.7~~	v2 : unknown v3 : 5.8
References	~~() https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html - Patch, Vendor Advisory~~	() https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html - Patch, Vendor Advisory

31 Oct 2022, 13:48

Type	Values Removed	Values Added
References	~~(CONFIRM) https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html -~~	(CONFIRM) https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html - Patch, Vendor Advisory
CWE		CWE-79
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.7
CPE		cpe:2.3:h:bosch:videojet_multi_4000:-:::::::* cpe:2.3:o:bosch:videojet_multi_4000_firmware::::::::

27 Oct 2022, 17:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-10-27 17:15

Updated : 2024-11-21 07:21

NVD link : CVE-2022-40183

Mitre link : CVE-2022-40183

CVE.ORG link : CVE-2022-40183

JSON object : View

Products Affected

bosch

videojet_multi_4000_firmware
videojet_multi_4000

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-40183", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@bosch.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "published": "2022-10-27T17:15:10.430", "references": [{"url": "https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@bosch.com"}, {"url": "https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@bosch.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user."}, {"lang": "es", "value": "Un error en el controlador de URL de VIDEOJET multi 4000 puede provocar un Cross Site Scripting (XSS) reflejado en la interfaz basado en web. Un atacante con conocimiento de la direcci\u00f3n del codificador puede enviar un enlace manipulando a un usuario, que ejecutar\u00e1 c\u00f3digo JavaScript en el contexto del usuario."}], "lastModified": "2024-11-21T07:21:01.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:videojet_multi_4000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "821A0ADF-1601-4688-B3E6-636748D48EE8", "versionEndIncluding": "6.31.0010"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:videojet_multi_4000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "19868F38-8A56-451C-AE74-FEADA0FDD6EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@bosch.com"}