Cross Site Scripting(XSS)

2024-03-0709:38:09

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

api

esphome

remote

injection

vulnerability

web scripts

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

Percentile

9.0%

JSON

esphome is vulnerable to Cross-Site Scripting (XSS). The vulnerability is due to unsanitized data being served with Content-Type: text/html; charset=UTF-8 in the API dashboard through Edit configuration file API. It allows a remote authenticated user to inject arbitrary web scripts and potentially execute malicious actions by exploiting the Cross-Site Scripting (XSS).