« Volver al listado

CVE-2021-23848

Estado: ModificadaMedia (6.1)—

An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Bosch — Cpp13 FirmwareBosch — Cpp4 FirmwareBosch — Cpp6 FirmwareBosch — Cpp7.3 FirmwareBosch — Cpp7 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-23848",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@bosch.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@bosch.com",
      "affectedData": [
        {
          "vendor": "Bosch",
          "product": "CPP Firmware",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ],
          "platforms": [
            "CPP4, CPP6, CPP7, CPP7.3, CPP13"
          ]
        }
      ]
    }
  ],
  "published": "2021-06-09T15:15:08.250",
  "references": [
    {
      "url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@bosch.com"
    },
    {
      "url": "https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@bosch.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user."
    },
    {
      "lang": "es",
      "value": "Un error en el controlador de URL de las cámaras Bosch IP puede conllevar a un ataque de tipo cross site scripting (XSS) reflejado en la interfaz basada en web. Un atacante con conocimiento de la dirección de la cámara puede enviar un enlace diseñado a un usuario, que ejecutará código javascript en el contexto del usuario"
    }
  ],
  "lastModified": "2026-06-17T03:38:55.593",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bosch:cpp4_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55C25C73-B8DF-4530-B59A-375AE426D2D8"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bosch:cpp4:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1F4FA4F9-6BDC-44C4-A151-16ECF7926A83"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bosch:cpp6_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2549BED9-6769-41AB-BE24-190ED45BC3C7"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bosch:cpp6:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "27B65C05-69F5-4048-BCBE-DA0D53EF9AFE"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bosch:cpp7_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85D3F004-3A77-4C40-9921-B775BC487B56"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bosch:cpp7:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E8339008-8889-47B0-9416-CCC6CE75D277"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bosch:cpp7.3_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A028085E-993B-4BE2-A88A-E89AAFAE905E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bosch:cpp7.3:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5B97B95A-8143-4766-9F10-87E19AED22C6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bosch:cpp13_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4600022D-EDD1-43D2-8098-A863A1A23821"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bosch:cpp13:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "80149FF9-3C6D-4C80-8257-CEB2BE8B0DCA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@bosch.com"
}