Lucene search
SWICVELIST:CVE-2023-40461HistoryDec 04, 2023 - 10:52 p.m.
CVE-2023-40461 Cross-site scripting vulnerability in ACEManager
2023-12-0422:52:13
CWE-79
SWI
www.cve.org
6
cross-site scripting
acemanager
aleos 4.16
stored cross-site scripting
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
AI Score
8.2
Confidence
High
EPSS
0
Percentile
14.0%
The ACEManager
component of ALEOS 4.16 and earlier allows an
authenticated user
with Administrator privileges to access a file
upload field which
does not fully validate the file name, creating a
Stored Cross-Site
Scripting condition.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "ALEOS",
"vendor": "SierraWireless",
"versions": [
{
"lessThanOrEqual": "4.16",
"status": "affected",
"version": "4.10",
"versionType": "Custom"
},
{
"lessThanOrEqual": "4.9.8",
"status": "affected",
"version": "0",
"versionType": "Custom"
}
]
}
]Related
cve
cve
CVE-2023-40461
2023-12-04 23:15:25
prion
prion
Cross site scripting
2023-12-04 23:15:00
nvd
nvd
CVE-2023-40461
2023-12-04 23:15:25
ics
ics
Sierra Wireless AirLink with ALEOS firmware
2023-12-07 12:00:00
CVSS3
8.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
AI Score
8.2
Confidence
High
EPSS
0
Percentile
14.0%
Related for CVELIST:CVE-2023-40461