Cross site scripting

2013-10-0119:55:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.0%

JSON

Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models before firmware 1.0.4.44, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

CPENameOperatorVersion
gxv_device_firmwarele1.0.4.43
gxv_device_firmwareeq1.0.2.3
gxv_device_firmwareeq1.0.3.9
gxv_device_firmwareeq1.0.4.6
gxv_device_firmwareeq1.0.4.7
gxv_device_firmwareeq1.0.4.11
gxv_device_firmwareeq1.0.4.16
gxv_device_firmwareeq1.0.4.27
gxv_device_firmwareeq1.0.4.34
gxv_device_firmwareeq1.0.4.37

Name	Operator	Version
gxv_device_firmware	le	1.0.4.43
gxv_device_firmware	eq	1.0.2.3
gxv_device_firmware	eq	1.0.3.9
gxv_device_firmware	eq	1.0.4.6
gxv_device_firmware	eq	1.0.4.7
gxv_device_firmware	eq	1.0.4.11
gxv_device_firmware	eq	1.0.4.16
gxv_device_firmware	eq	1.0.4.27
gxv_device_firmware	eq	1.0.4.34
gxv_device_firmware	eq	1.0.4.37