Stored Cross-Site Scripting in Moxa SDS-3008 Series Industrial Ethernet Switch
CVE-2022-41311

4.3MEDIUM

Key Information:

Vendor: Moxa
Status: Sds-3008 Series Industrial Ethernet Switch
Vendor: CVE Published:; 7 February 2023

What is CVE-2022-41311?

A stored cross-site scripting vulnerability exists in the web application functionality of the Moxa SDS-3008 Series Industrial Ethernet Switch v2.1. This vulnerability can be exploited through a specially-crafted HTTP request that allows attackers to execute arbitrary JavaScript in the context of the user's session. When an attacker sends a specific HTTP request targeting the field 'webLocationMessage_text', they can manipulate the web application to deliver malicious scripts, potentially compromising user security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SDS-3008 Series Industrial Ethernet Switch 2.1

References

https://talosintelligence.com/vulnerability_reports/TALOS...

https://www.moxa.com/en/support/product-support/security-...

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Unchanged

CVSS V3.0