CVE-2022-43376 — Cross-site Scripting in Netbotz 355 Firmware

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
CNA7.6
EPSS
0.4%
top 40.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Schneider-electric Netbotz 355 FirmwareSchneider-electric Netbotz 450 FirmwareSchneider-electric Netbotz 455 Firmware+3 more
Timeline
PublishedApr 18
Latest updateJul 6

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages6 packages

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2mxh-qvf4-48jc: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session↗2023-07-06
▶
CVEList
CVE-2022-43376: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session↗2023-04-18
▶
CVE-2022-43376 — Cross-site Scripting | cvebase