Vulnerability · Published Dec 8, 2021 · Assigned by bosch
CVE-2021-23860Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS
Medium 5.0
In plain English
A medium-severity cross-site scripting in BVMS from Bosch. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bosch | BVMS | unspecified – through 9.0.011.0 – before 11.0.010.0 – before 10.0.210.1 – before 10.1.1 |
| Bosch | DIVAR IP 7000 R2 | all |
| Bosch | DIVAR IP all-in-one 5000 | all |
| Bosch | DIVAR IP all-in-one 7000 | all |
| Bosch | VRM | unspecified – through 3.814.0 – through 4.00.00703.83 – through 3.83.00213.82 – through 3.82.0057 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html x_refsource_CONFIRM