Lucene search

IcscertCVE-2023-23553

HistoryFeb 13, 2023 - 6:15 p.m.

CVE-2023-23553

2023-02-1318:15:11

CWE-79

icscert

web.nvd.nist.gov

cve-2023-23553

control by web

x-400

cross-site scripting

data theft

vulnerability

nvd

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

40.3%

JSON

Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the attacker.

Affected configurations

Nvd

Node

controlbywebx-400_firmwareRange<2.8

AND

controlbywebx-400Match-

VendorProductVersionCPE
controlbywebx-400_firmware*cpe:2.3:o:controlbyweb:x-400_firmware:*:*:*:*:*:*:*:*
controlbywebx-400-cpe:2.3:h:controlbyweb:x-400:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
controlbyweb	x-400_firmware	*	cpe:2.3:o:controlbyweb:x-400_firmware::::::::
controlbyweb	x-400	-	cpe:2.3:h:controlbyweb:x-400:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "X-400 devices",
    "vendor": "Control By Web",
    "versions": [
      {
        "lessThan": "2.8",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-23-040-01

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

40.3%

JSON

Related for CVE-2023-23553