CVE-2023-3971CWE-80

Controller: html injection in custom login info

High · published October 4, 2023

CVSS v3.1
7.3
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2023-10-04T14:26Z
EPSS history
Timeline
  • 04 OCT 14:26Z
    Controller: html injection in custom login info
    cvelistv5