The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is accessed that does not exist. However, the value of the path is reflected in the response. As the application will reflect the supplied path without context-sensitive HTML encoding, it is vulnerable to reflective cross-site scripting (XSS).
References
| Link | Resource |
|---|---|
| https://www.syss.de/en/responsible-disclosure-policy | Not Applicable |
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-016.txt | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
07 Jul 2023, 18:39
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gira
Gira knx Ip Router Gira knx Ip Router Firmware |
|
| CPE | cpe:2.3:o:gira:knx_ip_router_firmware:3.1.3683.0:*:*:*:*:*:*:* cpe:2.3:o:gira:knx_ip_router_firmware:3.3.8.0:*:*:*:*:*:*:* cpe:2.3:h:gira:knx_ip_router:-:*:*:*:*:*:*:* |
|
| CWE | CWE-79 | |
| References | (MISC) https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-016.txt - Exploit, Third Party Advisory | |
| References | (MISC) https://www.syss.de/en/responsible-disclosure-policy - Not Applicable | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
30 Jun 2023, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-30 14:15
Updated : 2024-02-28 20:13
NVD link : CVE-2023-33276
Mitre link : CVE-2023-33276
CVE.ORG link : CVE-2023-33276
JSON object : View
Products Affected
gira
- knx_ip_router_firmware
- knx_ip_router
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')