Stored Cross-Site Scripting in Moxa SDS-3008 Series Industrial Ethernet Switch
CVE-2022-41311
4.3MEDIUM
Key Information:
- Vendor
- Moxa
- Vendor
- CVE Published:
- 7 February 2023
Summary
A stored cross-site scripting vulnerability exists in the web application functionality of the Moxa SDS-3008 Series Industrial Ethernet Switch v2.1. This vulnerability can be exploited through a specially-crafted HTTP request that allows attackers to execute arbitrary JavaScript in the context of the user's session. When an attacker sends a specific HTTP request targeting the field 'webLocationMessage_text', they can manipulate the web application to deliver malicious scripts, potentially compromising user security.
Affected Version(s)
SDS-3008 Series Industrial Ethernet Switch 2.1
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged
CVSS V3.0
Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved