CVE-2022-40184

Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000

State: Published
Severity: 5.1 Medium
Published: Oct 27, 2022
Updated: May 9, 2025
Reserved: Sep 8, 2022

Description

Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option.

Scores

CVSS	Score	Vector	Source
3.1	5.1 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L	bosch

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
VIDEOJET multi 4000Bosch	6.31.0010 and earlierAffected

References

https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.