CVE-2023-1841CWE-79

Honeywell MPA2 Web Application XSS vulnerability

High · published February 29, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05.

Honeywell released firmware update package MPA2 firmware R1.00.08.05 which addresses this vulnerability. This version and all later versions

correct the reported vulnerability.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00372 · 30.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-02-29T05:09Z
EPSS history
Timeline
  • 29 FEB 05:09Z
    Honeywell MPA2 Web Application XSS vulnerability
    cvelistv5