CVE-2020-25205

MEDIUM

6.1

Descripcion

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.

Detalles CVE

Puntuacion CVSS v3.16.1

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado7/20/2021

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

mimosa:b5mimosa:b5_firmwaremimosa:b5cmimosa:b5c_firmwaremimosa:c5cmimosa:c5c_firmware

Debilidades (CWE)

CWE-79

Referencias

https://labs.f-secure.com/advisories/(cve@mitre.org)

https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/(cve@mitre.org)

https://labs.f-secure.com/advisories/(af854a3a-2127-422b-91ae-364da2661108)

https://labs.f-secure.com/advisories/mimosa-ptp-devices-multiple-vulnerabilities/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.