Lucene search

IcscertCVELIST:CVE-2023-23553

HistoryFeb 13, 2023 - 5:03 p.m.

CVE-2023-23553 X-400 Cross-Site Scripting

2023-02-1317:03:44

CWE-79

icscert

www.cve.org

cross-site scripting

control by web

x-400

vulnerability

information security

attack

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

40.3%

JSON

Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the attacker.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "X-400 devices",
    "vendor": "Control By Web",
    "versions": [
      {
        "lessThan": "2.8",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-23-040-01

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

40.3%

JSON

Related for CVELIST:CVE-2023-23553