Cross site scripting

2023-06-3014:15:00

PRIOn knowledge base

www.prio-n.com

gira knx/ip-router

vulnerability

reflective cross site scripting

xss

unencoded path

response

0.001 Low

EPSS

Percentile

20.5%

JSON

The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a “404 - Not Found” status code if a path is accessed that does not exist. However, the value of the path is reflected in the response. As the application will reflect the supplied path without context-sensitive HTML encoding, it is vulnerable to reflective cross-site scripting (XSS).

CPENameOperatorVersion
knx_ip_router_firmwareeq3.1.3683.0
knx_ip_router_firmwareeq3.3.8.0

CPE	Name	Operator	Version
	knx_ip_router_firmware	eq	3.1.3683.0
	knx_ip_router_firmware	eq	3.3.8.0

References

www.syss.de/en/responsible-disclosure-policy

www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-016.txt

0.001 Low

EPSS

Percentile

20.5%

JSON

Related for PRION:CVE-2023-33276