CVE-2022-40204

A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages after login.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.digitalalertsystems.com/security-advisory	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:digitalalertsystems:dasdec_ii_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:dasdec_ii:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:digitalalertsystems:one-net_se_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:one-net_se:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:digitalalertsystems:dasdec_i_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:dasdec_i:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:digitalalertsystems:one-net_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:one-net:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:digitalalertsystems:dasdec_iii_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:digitalalertsystems:dasdec_iii:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-01 00:15

Updated : 2022-12-09 00:41

NVD link : CVE-2022-40204

Mitre link : CVE-2022-40204

CVE.ORG link : CVE-2022-40204

JSON object : View

Products Affected

digitalalertsystems

dasdec_i
one-net_firmware
dasdec_iii_firmware
one-net_se
dasdec_ii
dasdec_ii_firmware
dasdec_iii
one-net
dasdec_i_firmware
one-net_se_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-40204", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "published": "2022-12-01T00:15:09.883", "references": [{"url": "https://www.digitalalertsystems.com/security-advisory", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages after login."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) en todas las versiones actuales del software DASDEC de Digital Alert Systems a trav\u00e9s del encabezado del host en p\u00e1ginas no divulgadas despu\u00e9s de iniciar sesi\u00f3n."}], "lastModified": "2022-12-09T00:41:31.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:dasdec_ii_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D30335FF-D465-4953-BB70-EF4A980D306A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:dasdec_ii:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DE615E7B-7927-4005-BD6E-A31F4DBD6ABC"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:one-net_se_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13D8C627-F4F6-4A89-90CE-F2FCB7856291"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:one-net_se:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7FA3908B-1672-4986-A909-44EDF6A11051"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:dasdec_i_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66BD373D-B465-4D70-958D-AA130874B693"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:dasdec_i:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C704906A-0F64-46F3-9292-C71F4C35C0DA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:one-net_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24191CF1-CDDB-4278-8C8E-A540677AE9A3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:one-net:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "407CA3A2-FDB1-45E5-85C5-4DE76D9C5AC4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:digitalalertsystems:dasdec_iii_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E6F6E1-B8CC-452A-AA73-412204742610"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:digitalalertsystems:dasdec_iii:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E51CB83E-8B57-436D-9599-744B0C6EB91B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}