CVE-2021-23860CWE-79

Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS

Medium · published December 8, 2021

CVSS v3.1
5.0
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-08T21:17Z
EPSS history
Timeline
  • 08 DEC 21:17Z
    Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS
    cvelistv5