CVE-2023-34412
Assigner: CERTVDE
Published: 2023-08-17T13:07:01.697Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: mbNET
vendor: Red Lion Europe
versions: lessThan: 7.3.2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: mbNET.rokey
vendor: Red Lion Europe
versions: lessThan: 7.3.2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: REX 200
vendor: Helmholz
versions: lessThan: 7.3.2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: REX 250
vendor: Helmholz
versions: lessThan: 7.3.2
status: affected
version: 0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an
authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
value: A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an
authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
source: defect: CERT@VDE#64536
discovery: UNKNOWN
title: Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250
x_generator: engine: Vulnogram 0.1.0-dev