What is the CVSS score of CVE-2022-3073?

CVE-2022-3073 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

19 Iot Md01 Lan H4 S0011 Firmware CVE-2022-3073

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2022-12-14 info@cert.vde.com

XSS 19 Iot Md01 Lan H4 S0011 Firmware Fp Iot Md01 4Eu S2 00000 Firmware Fp Iot Md01 Lan S2 00000 Firmware Fp Iot Md01 Lan S2 00011 Firmware Fp Iot Md02 4Eu S3 00000 Firmware Iot Gw30 Firmware Iot Gw30 4G Eu Firmware Uc20 Wl2000 Ac Firmware Uc20 Wl2000 Iot Firmware

6.1

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Dec 14, 2022 - 09:15 cve.org

MEDIUM 6.1

DescriptionCVE.org

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.

AnalysisAI

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'. Affected products include: Weidmueller 19 Iot Md01 Lan H4 S0011 Firmware, Weidmueller Fp Iot Md01 4Eu S2 00000 Firmware, Weidmueller Fp Iot Md01 Lan S2 00000 Firmware, Weidmueller Fp Iot Md01 Lan S2 00011 Firmware, Weidmueller Fp Iot Md02 4Eu S3 00000 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.