CVE-2021-23860 | ByteOS Network

Vulnerability Details :

CVE-2021-23860

Assigner-bosch

Assigner Org ID-c95f66b2-7e7c-41c5-8f09-6f86ec68659c

Published At-08 Dec, 2021 | 21:17

Updated At-17 Sep, 2024 | 03:52

Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS

An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:bosch

Assigner Org ID:c95f66b2-7e7c-41c5-8f09-6f86ec68659c

Published At:08 Dec, 2021 | 21:17

Updated At:17 Sep, 2024 | 03:52

▼CVE Numbering Authority (CNA)

Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS

An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.

Affected Products

Vendor

Robert Bosch GmbH

Product

Versions

Affected

From unspecified through 9.0.0 (custom)
From 11.0 before 11.0.0 (custom)
From 10.0 before 10.0.2 (custom)
From 10.1 before 10.1.1 (custom)

Vendor

Robert Bosch GmbH

Product

DIVAR IP 7000 R2

Versions

Affected

all

Vendor

Robert Bosch GmbH

Product

DIVAR IP all-in-one 5000

Versions

Affected

all

Vendor

Robert Bosch GmbH

Product

DIVAR IP all-in-one 7000

Versions

Affected

all

Vendor

Robert Bosch GmbH

Product

Versions

Affected

From unspecified through 3.81 (custom)
From 4.0 through 4.00.0070 (custom)
From 3.83 through 3.83.0021 (custom)
From 3.82 through 3.82.0057 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.0	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Version: 3.1

Base score: 5.0

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References

Hyperlink	Resource
https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html	x_refsource_CONFIRM

Hyperlink: https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html	x_refsource_CONFIRM x_transferred

Hyperlink: https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@bosch.com

Published At:08 Dec, 2021 | 22:15

Updated At:14 Dec, 2021 | 16:36

An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	5.0	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.0

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Robert Bosch GmbH

>>divar_ip_5000_firmware>>-

cpe:2.3:o:bosch:divar_ip_5000_firmware:-:*:*:*:*:*:*:*

Robert Bosch GmbH

>>divar_ip_7000_firmware>>-

cpe:2.3:o:bosch:divar_ip_7000_firmware:-:*:*:*:*:*:*:*

Robert Bosch GmbH

>>bosch_video_management_system>>Versions up to 9.0(inclusive)

cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:*

Robert Bosch GmbH

>>bosch_video_management_system>>Versions from 10.0(inclusive) to 10.0.2(exclusive)

cpe:2.3:a:bosch:bosch_video_management_system:*:*:*:*:*:*:*:*

Robert Bosch GmbH

>>bosch_video_management_system>>10.1

cpe:2.3:a:bosch:bosch_video_management_system:10.1:*:*:*:*:*:*:*

Robert Bosch GmbH

>>bosch_video_management_system>>11.0

cpe:2.3:a:bosch:bosch_video_management_system:11.0:*:*:*:*:*:*:*

Robert Bosch GmbH

>>video_recording_manager>>Versions up to 3.81(inclusive)

cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*

Robert Bosch GmbH

>>video_recording_manager>>Versions from 3.82(inclusive) to 3.82.0057(inclusive)

cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*

Robert Bosch GmbH

>>video_recording_manager>>Versions from 3.83(inclusive) to 3.83.0021(inclusive)

cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*

Robert Bosch GmbH

>>video_recording_manager>>Versions from 4.0(inclusive) to 4.00.0070(inclusive)

cpe:2.3:a:bosch:video_recording_manager:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	psirt@bosch.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: psirt@bosch.com

References

Hyperlink	Source	Resource
https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html	psirt@bosch.com	Vendor Advisory

Hyperlink: https://psirt.bosch.com/security-advisories/bosch-sa-043434-bt.html

Source: psirt@bosch.com

Resource:

Vendor Advisory