CVE-2023-4667

Stored Cross Site Scripting in webserver administration

State: Published
Severity: 8.1 High
Published: Nov 28, 2023
Updated: Oct 17, 2024
Reserved: Aug 31, 2023

Description

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface.

The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.

This could lead to unauthorized access and data leakage

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N	IDEMIA

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
SIGMA Lite & Lite +IDEMIA	0Affected
SIGMA WideIDEMIA	0Affected
SIGMA ExtremeIDEMIA	0Affected
MorphoWave Compact/XPIDEMIA	0Affected
VisionPassIDEMIA	0Affected
MorphoWave SPIDEMIA	0Affected

References

https://www.idemia.com/vulnerability-information

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.