Sign-up

ID

VAR-202106-1411


CVE

CVE-2021-23854


TITLE

Bosch IP cameras cross-site scripting vulnerability

Trust: 1.2

sources: CNVD: CNVD-2021-53974 // CNNVD: CNNVD-202106-744

DESCRIPTION

An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected. Bosch IP There is a cross-site scripting vulnerability in the camera.Information may be obtained and information may be tampered with. Bosch IP cameras are German (Bosch) network cameras. No detailed vulnerability details are currently provided. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.79

sources: NVD: CVE-2021-23854 // JVNDB: JVNDB-2021-007991 // CNVD: CNVD-2021-53974 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-23854

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-53974

AFFECTED PRODUCTS

vendor:boschmodel:cpp7.3scope:eqversion:7.72

Trust: 1.0

vendor:boschmodel:cpp7scope:eqversion:7.72

Trust: 1.0

vendor:boschmodel:cpp7.3scope:eqversion:7.62

Trust: 1.0

vendor:boschmodel:cpp13scope:eqversion:7.75

Trust: 1.0

vendor:boschmodel:cpp6scope:eqversion:7.72

Trust: 1.0

vendor:boschmodel:cpp7.3scope:eqversion:7.70

Trust: 1.0

vendor:boschmodel:cpp13scope:eqversion:7.76

Trust: 1.0

vendor:boschmodel:cpp7scope:eqversion:7.70

Trust: 1.0

vendor:boschmodel:cpp7scope:eqversion:7.62

Trust: 1.0

vendor:boschmodel:cpp6scope:eqversion:7.70

Trust: 1.0

vendor:boschmodel:cpp6scope:eqversion:7.62

Trust: 1.0

vendor:robert boschmodel:cpp13scope: - version: -

Trust: 0.8

vendor:robert boschmodel:cpp6scope: - version: -

Trust: 0.8

vendor:robert boschmodel:cpp7scope: - version: -

Trust: 0.8

vendor:robert boschmodel:cpp7.3scope: - version: -

Trust: 0.8

vendor:boschmodel:ip camerasscope:eqversion:7.7*

Trust: 0.6

vendor:boschmodel:ip camerasscope:eqversion:7.6*

Trust: 0.6

sources: CNVD: CNVD-2021-53974 // JVNDB: JVNDB-2021-007991 // NVD: CVE-2021-23854

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-23854
value: MEDIUM

Trust: 1.0

psirt@bosch.com: CVE-2021-23854
value: HIGH

Trust: 1.0

NVD: CVE-2021-23854
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-53974
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202106-744
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-23854
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-23854
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-53974
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-23854
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

psirt@bosch.com: CVE-2021-23854
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2021-23854
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-53974 // VULMON: CVE-2021-23854 // JVNDB: JVNDB-2021-007991 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-744 // NVD: CVE-2021-23854 // NVD: CVE-2021-23854

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-007991 // NVD: CVE-2021-23854

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-744

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:BOSCH-SA-478243-BTurl:https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html

Trust: 0.8

title:Patch for Bosch IP cameras cross-site scripting vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/280706

Trust: 0.6

title:Bosch IP cameras Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=154911

Trust: 0.6

sources: CNVD: CNVD-2021-53974 // JVNDB: JVNDB-2021-007991 // CNNVD: CNNVD-202106-744

EXTERNAL IDS

db:NVDid:CVE-2021-23854

Trust: 3.9

db:JVNDBid:JVNDB-2021-007991

Trust: 0.8

db:CNVDid:CNVD-2021-53974

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021070710

Trust: 0.6

db:CNNVDid:CNNVD-202106-744

Trust: 0.6

db:VULMONid:CVE-2021-23854

Trust: 0.1

sources: CNVD: CNVD-2021-53974 // VULMON: CVE-2021-23854 // JVNDB: JVNDB-2021-007991 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-744 // NVD: CVE-2021-23854

REFERENCES

url:https://psirt.bosch.com/security-advisories/bosch-sa-478243-bt.html

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-23854

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021070710

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/79.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-53974 // VULMON: CVE-2021-23854 // JVNDB: JVNDB-2021-007991 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-744 // NVD: CVE-2021-23854

SOURCES

db:CNVDid:CNVD-2021-53974
db:VULMONid:CVE-2021-23854
db:JVNDBid:JVNDB-2021-007991
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202106-744
db:NVDid:CVE-2021-23854

LAST UPDATE DATE

2024-08-14T12:47:19.341000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-53974date:2021-07-23T00:00:00
db:VULMONid:CVE-2021-23854date:2021-06-17T00:00:00
db:JVNDBid:JVNDB-2021-007991date:2022-03-01T08:32:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202106-744date:2021-07-08T00:00:00
db:NVDid:CVE-2021-23854date:2021-06-17T16:47:14.217

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-53974date:2021-07-23T00:00:00
db:VULMONid:CVE-2021-23854date:2021-06-09T00:00:00
db:JVNDBid:JVNDB-2021-007991date:2022-03-01T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202106-744date:2021-06-09T00:00:00
db:NVDid:CVE-2021-23854date:2021-06-09T15:15:08.437