CVE-2022-28816

Reflected XSS in Carlo Gavazzi UWP 3.0

State: Published
Severity: 6.1 Medium
Published: Sep 28, 2022
Updated: May 20, 2025
Reserved: Apr 8, 2022

Description

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CERTVDE

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
UWP 3.0 Monitoring Gateway and ControllerCarlo Gavazzi	8 to before 8.5.0.3Affected
UWP 3.0 Monitoring Gateway and Controller – Security EnhancedCarlo Gavazzi	8 to before 8.5.0.3Affected
UWP 3.0 Monitoring Gateway and Controller – EDP versionCarlo Gavazzi	8 to before 8.5.0.3Affected
CPY Car Park ServerCarlo Gavazzi	2 to before 2.8.3Affected

References

https://cert.vde.com/en/advisories/VDE-2022-029/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.