5.4

CVE-2022-42786

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wut ≫ At-modem-emulator Firmware Version < 1.48
   Wut ≫ At-modem-emulator Version-
Wut ≫ Com-server ++ Firmware Version < 1.48
   Wut ≫ Com-server ++ Version-
Wut ≫ Com-server 20ma Firmware Version < 1.48
   Wut ≫ Com-server 20ma Version-
Wut ≫ Com-server Highspeed Oem Firmware Version < 1.76
   Wut ≫ Com-server Highspeed Oem Version-
Wut ≫ Com-server Highspeed Poe Firmware Version < 1.76
   Wut ≫ Com-server Highspeed Poe Version-
Wut ≫ Com-server Highspeed Lc Firmware Version < 1.48
   Wut ≫ Com-server Highspeed Lc Version-
Wut ≫ Com-server Highspeed Ul Firmware Version < 1.48
   Wut ≫ Com-server Highspeed Ul Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.06% 0.198
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
info@cert.vde.com 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.