CVE-2022-3073
Medium
Description
Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.
SeverityMedium
CVSS6.1
Exploit probability—
ProductWeidmueller 19 Iot Md01 Lan H4 S0011 Firmware
PublishedDec 14, 2022
First seenDec 14, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| weidmueller 19_iot_md01_lan_h4_s0011_firmware | No range specified | — |
| weidmueller fp_iot_md01_4eu_s2_00000_firmware | No range specified | — |
| weidmueller fp_iot_md01_lan_s2_00000_firmware | No range specified | — |
| weidmueller fp_iot_md01_lan_s2_00011_firmware | No range specified | — |
| weidmueller fp_iot_md02_4eu_s3_00000_firmware | No range specified | — |
| weidmueller iot-gw30_firmware | v ≤ 1.16.0 | — |
| weidmueller iot-gw30-4g-eu_firmware | v ≤ 1.16.0 | — |
| weidmueller uc20-wl2000-ac_firmware | v ≤ 1.16.0 | — |
| weidmueller uc20-wl2000-iot_firmware | v ≤ 1.16.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.