Reflected XSS in URL handler
CVE-2021-23848

8.3HIGH

Key Information:

Vendor

Bosch
Status
Cpp Firmware
Vendor
CVE Published:
9 June 2021

What is CVE-2021-23848?

An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.

Affected Version(s)

CPP Firmware CPP4, CPP6, CPP7, CPP7.3, CPP13 all

References

https://psirt.bosch.com/security-advisories/bosch-sa-4782...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.