CVE-2023-4667

Опубликовано: 28 нояб. 2023

Источник: nvd

CVSS3: 8.1

CVSS3: 4.8

EPSS Низкий

Описание

The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.

This could lead to unauthorized access and data leakage

Ссылки

https://www.idemia.com/vulnerability-information
Vendor Advisory
https://www.idemia.com/vulnerability-information
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:idemia:sgima_lite_\&_lite\+_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:sgima_lite_\&_lite\+:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:sigma_wide:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:sigma_extreme:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:morphowave_compact:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:idemia:visionpass_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:visionpass:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:*

EPSS

Процентиль: 29%

0.00103

Низкий

8.1 High

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-5585-c8pm-rcfv

CVSS3: 8.1

github

около 2 лет назад

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage

EPSS

Процентиль: 29%

0.00103

Низкий

8.1 High

CVSS3

4.8 Medium

CVSS3

Дефекты

CWE-79