CVE-2022-40184 Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000
An attacker with admin credentials can inject JavaScript into configuration fields, executing code for other administrators accessing the same settings.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-40184?
CVE-2022-40184 is a medium-severity cross-site scripting vulnerability in Bosch VIDEOJET multi 4000, published on 27 Oct 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option.
Weakness: CWE-79
Which versions are affected by CVE-2022-40184?
It affects 1 product.
Products include Bosch Videojet Multi 4000 Firmware.
How do I fix CVE-2022-40184?
No fix has been published for CVE-2022-40184 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-40184 being exploited?
There is no known exploitation of CVE-2022-40184 in the wild and no public exploit code.
Other vulnerabilities in Bosch VIDEOJET multi 4000
Sources
Also known as GHSA-wvhm-r52c-qwwh.