CVE-2022-40183

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:bosch:videojet_multi_4000_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:bosch:videojet_multi_4000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-10-27 17:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-40183

Mitre link : CVE-2022-40183

CVE.ORG link : CVE-2022-40183

JSON object : View

Products Affected

bosch

videojet_multi_4000
videojet_multi_4000_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-40183", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "psirt@bosch.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.6}]}, "published": "2022-10-27T17:15:10.430", "references": [{"url": "https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@bosch.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "psirt@bosch.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user."}, {"lang": "es", "value": "Un error en el controlador de URL de VIDEOJET multi 4000 puede provocar un Cross Site Scripting (XSS) reflejado en la interfaz basado en web. Un atacante con conocimiento de la direcci\u00f3n del codificador puede enviar un enlace manipulando a un usuario, que ejecutar\u00e1 c\u00f3digo JavaScript en el contexto del usuario."}], "lastModified": "2022-10-31T13:48:22.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:bosch:videojet_multi_4000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "821A0ADF-1601-4688-B3E6-636748D48EE8", "versionEndIncluding": "6.31.0010"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:bosch:videojet_multi_4000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "19868F38-8A56-451C-AE74-FEADA0FDD6EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@bosch.com"}