CVE-2021-22810 — Cross-site Scripting in Network Management Card 2 Firmware

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 34.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Schneider-electric Network Management Card 2 FirmwareSchneider-electric Network Management Card 3 Firmware
Timeline
PublishedJan 28
Latest updateJan 29

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to a delete policy file. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP96…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-qpf2-w9g6-82x6: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script↗2022-01-29
▶
CVEList
CVE-2021-22810: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script↗2022-01-28
▶
CVE-2021-22810 — Cross-site Scripting | cvebase