IM
IronMonkey Threat Research

CVE-2022-43376 HIGH

Published: 2023-04-18 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)

CVSS Metrics

Base Score: 6.1 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeCHANGED
Confidentiality ImpactLOW
Integrity ImpactLOW
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 2.7

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-79

Affected Products

Vendor Product Version Update Type
schneider-electric netbotz_355_firmware * <built-in method update of dict object at 0x7e60eb2247c0> Operating System
schneider-electric netbotz_450_firmware * <built-in method update of dict object at 0x7e60a88aca80> Operating System
schneider-electric netbotz_455_firmware * <built-in method update of dict object at 0x7e613ce32380> Operating System
schneider-electric netbotz_550_firmware * <built-in method update of dict object at 0x7e60eb2250c0> Operating System
schneider-electric netbotz_570_firmware * <built-in method update of dict object at 0x7e60eb226ac0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_355_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_355:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_450_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_450:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_455_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_455:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_550_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_550:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_570_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_570:-:*:*:*:*:*:*:*

References

Notification
Message here