CVE-2021-40223

Published: Sep 9, 2021Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog, Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts). The XSS payload will be triggered when the user accesses some specific sections of the application.

Affected (1)

Products: Rittal: Cmc Pu Iii 7030.000 Firmware

1 product

Cmc Pu Iii 7030.000 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Rittal Cmc Pu Iii 7030.000 Firmware	From 3.11.00_2 to 3.17.10

Running on/with	Platform Versions
Rittal Cmc Pu Iii 7030.000	Version 3.00

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/asang17/CVE-2021-XSS

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/asang17/CVE-2021-XSS

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.