CVE-2023-1841 Vulnerability Details

  /     /     /  

CVE-2023-1841 Metadata Quick Info

CVE Published: 29/02/2024 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: Honeywell | Vendor: Honeywell | Product: MPA2 Access Panel
Status : PUBLISHED

---

CVE-2023-1841 Description

Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\') vulnerability in Honeywell MPA2 Access Panel (Web server modules) allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05.  Honeywell released firmware update package MPA2 firmware R1.00.08.05 which addresses this vulnerability. This version and all later versions correct the reported vulnerability.

Metrics

CVSS Version: 3.1 | Base Score: 8.1 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: CWE-79 Improper Neutralization of Input During Web Page Generation ( Cross-site Scripting )
Source: Honeywell

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-247
CAPEC Description: CAPEC-247 XSS Using Invalid Characters


Source: NVD (National Vulnerability Database).