Medium severity · published Oct 27, 2022
CVE-2022-40184
Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VM
VIDEOJET multi 4000 · Bosch
through 6.31.0010 · source: vendor
VM
Videojet Multi 4000 Firmware · Bosch
through 6.31.0010 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40184
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40184
Patch
https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html
More from VIDEOJET multi 4000
4.7
CVE-2022-40183
Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000