Lucene search

[email protected]NVD:CVE-2023-48255

HistoryJan 10, 2024 - 1:15 p.m.

CVE-2023-48255

2024-01-1013:15:46

CWE-79

[email protected]

web.nvd.nist.gov

vulnerability

remote attacker

malicious network requests

client-side script code

victim’s session

crafted url

http request

poisoned log

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

27.9%

JSON

The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned log.

Affected configurations

NVD

Node

boschnexo-osRange1000–1500-sp2

AND

boschnexo_cordless_nutrunner_nxa011s-36v-b_\(0608842012\)Match-

boschnexo_cordless_nutrunner_nxa011s-36v_\(0608842011\)Match-

boschnexo_cordless_nutrunner_nxa015s-36v-b_\(0608842006\)Match-

boschnexo_cordless_nutrunner_nxa015s-36v_\(0608842001\)Match-

boschnexo_cordless_nutrunner_nxa030s-36v-b_\(0608842007\)Match-

boschnexo_cordless_nutrunner_nxa030s-36v_\(0608842002\)Match-

boschnexo_cordless_nutrunner_nxa050s-36v-b_\(0608842008\)Match-

boschnexo_cordless_nutrunner_nxa050s-36v_\(0608842003\)Match-

boschnexo_cordless_nutrunner_nxa065s-36v-b_\(0608842014\)Match-

boschnexo_cordless_nutrunner_nxa065s-36v_\(0608842013\)Match-

boschnexo_cordless_nutrunner_nxp012qd-36v-b_\(0608842010\)Match-

boschnexo_cordless_nutrunner_nxp012qd-36v_\(0608842005\)Match-

boschnexo_cordless_nutrunner_nxv012t-36v-b_\(0608842016\)Match-

boschnexo_cordless_nutrunner_nxv012t-36v_\(0608842015\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2272\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2301\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2514\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2515\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2666\)Match-

boschnexo_special_cordless_nutrunner_\(0608pe2673\)Match-

References

psirt.bosch.com/security-advisories/BOSCH-SA-711465.html

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

27.9%

JSON

Related for NVD:CVE-2023-48255

prion1 cvelist1 cve1