CVE-2023-34412 MEDIUM

CVE-2023-34412: Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250

Vendor Red Lion Europe
Product mbNET
Weakness CWE-79 · XSS
Published August 17, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).

Key dates

02Disclosure timeline

August 17, 2023 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-24201 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element CVE-2024-5612 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget CVE-2024-24932 WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) CVE-2021-34356 Stored XSS Vulnerability in Photo Station CVE-2024-1029 Cogites eReserv tenancyDetail.php cross site scripting