CVE-2021-23860

🗓️ 08 Dec 2021 21:17:28Reported by boschType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 45 Views

An error in VRM page handler leading to reflected XSS in web interface

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2021-23860	9 Dec 202100:24	–	circl
CNNVD	Bosch 多款产品跨站脚本漏洞	8 Dec 202100:00	–	cnnvd
Cvelist	CVE-2021-23860 Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS	8 Dec 202121:17	–	cvelist
EUVD	EUVD-2021-10786	7 Oct 202500:30	–	euvd
NVD	CVE-2021-23860	8 Dec 202122:15	–	nvd
Prion	Cross site scripting	8 Dec 202122:15	–	prion

NVD

Node

bosch bosch_video_management_systemRange≤9.0

bosch bosch_video_management_systemRange10.0–10.0.2

bosch bosch_video_management_systemMatch10.1

bosch bosch_video_management_systemMatch11.0

bosch video_recording_managerRange≤3.81

bosch video_recording_managerRange3.82–3.82.0057

bosch video_recording_managerRange3.83–3.83.0021

bosch video_recording_managerRange4.0–4.00.0070

AND

bosch divar_ip_5000_firmwareMatch-

bosch divar_ip_7000_firmwareMatch-

[
  {
    "product": "BVMS",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "9.0.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.0",
        "status": "affected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThan": "10.0.2",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "lessThan": "10.1.1",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "DIVAR IP 7000 R2",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "DIVAR IP all-in-one 5000",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "DIVAR IP all-in-one 7000",
    "vendor": "Bosch",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  },
  {
    "product": "VRM",
    "vendor": "Bosch",
    "versions": [
      {
        "lessThanOrEqual": "3.81",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "4.00.0070",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.83.0021",
        "status": "affected",
        "version": "3.83",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.82.0057",
        "status": "affected",
        "version": "3.82",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
psirt	www.psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html

21 Nov 2024 05:51Current

5.4Medium risk

Vulners AI Score5.4

CVSS 24.3

CVSS 3.15 - 6.1

EPSS0.00251

CWE-79