CVE-2022-41311

A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="webLocationMessage_text" name="webLocationMessage_text"
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:moxa:sds-3008_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:sds-3008:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:moxa:sds-3008-t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:sds-3008-t:-:*:*:*:*:*:*:*

History

16 Feb 2023, 14:33

Type Values Removed Values Added
CPE cpe:2.3:h:moxa:sds-3008-t:-:*:*:*:*:*:*:*
cpe:2.3:o:moxa:sds-3008_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:moxa:sds-3008:-:*:*:*:*:*:*:*
cpe:2.3:o:moxa:sds-3008-t_firmware:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.4
First Time Moxa sds-3008 Firmware
Moxa sds-3008-t
Moxa
Moxa sds-3008-t Firmware
Moxa sds-3008
References (MISC) https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities - (MISC) https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities - Vendor Advisory
References (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619 - (MISC) https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619 - Exploit, Third Party Advisory
CWE CWE-79

07 Feb 2023, 18:24

Type Values Removed Values Added
New CVE

Information

Published : 2023-02-07 17:15

Updated : 2023-12-10 14:48


NVD link : CVE-2022-41311

Mitre link : CVE-2022-41311

CVE.ORG link : CVE-2022-41311


JSON object : View

Products Affected

moxa

  • sds-3008_firmware
  • sds-3008-t
  • sds-3008-t_firmware
  • sds-3008
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')