CVE-2022-40184

Published: Oct 27, 2022Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option.

Affected (1)

Products: Bosch: Videojet Multi 4000 Firmware

1 product

Videojet Multi 4000 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Bosch Videojet Multi 4000 Firmware	Up to 6.31.0010

Running on/with	Platform Versions
Bosch Videojet Multi 4000	All versions

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html

Source: psirt@bosch.com

PatchVendor Advisory

https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.