CVE-2022-3073

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.

Score

CVSS 3.1 6.1 Medium

Status

Modified - info@cert.vde.com

Published

2022-12-14

Last modified

2025-04-17

Weaknesses

CWE-79

Affected products

• Schema St4 Example Web Templates (Quanos)
• 19 Iot Md01 Lan H4 S0011 Firmware (Weidmueller)
• Fp Iot Md01 4eu S2 00000 Firmware (Weidmueller)
• Fp Iot Md01 Lan S2 00000 Firmware (Weidmueller)
• Fp Iot Md01 Lan S2 00011 Firmware (Weidmueller)
• Fp Iot Md02 4eu S3 00000 Firmware (Weidmueller)
• Iot-gw30-4g-eu Firmware (Weidmueller)
• Iot-gw30 Firmware (Weidmueller)
• Uc20-wl2000-ac Firmware (Weidmueller)
• Uc20-wl2000-iot Firmware (Weidmueller)

References

• https://cert.vde.com/de/advisories/VDE-2022-056/