CVE-2023-4667: high-severity vulnerability in IDEMIA MorphoWave Compact/XP
Stored Cross Site Scripting in webserver administration
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.4%
The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface.
The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.
This could lead to unauthorized access and data leakage
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected products
IDEMIA · MorphoWave Compact/XPIDEMIA · MorphoWave SPIDEMIA · SIGMA ExtremeIDEMIA · SIGMA Lite & Lite +IDEMIA · SIGMA WideIDEMIA · VisionPassRelated CVEs — IDEMIA MorphoWave Compact/XP
In the same product, most dangerous first.
CVE-2023-33222MEDIUMStack buffer overflow when reading DESFire cardEPSS 1.3%CVE-2023-33220CRITICALStack Buffer Overflow when checking some attributes during retrofitEPSS 1.1%CVE-2023-33219CRITICALStack Buffer Overflow when checking retrofit packageEPSS 1.1%CVE-2023-33218CRITICALStack Buffer Overflow in a binary run at upgrade startupEPSS 1.1%CVE-2023-33221MEDIUM Heap Buffer Overflow when reading DESFire cardEPSS 1.0%CVE-2023-33217HIGHMissing integrity check on upgrade packageEPSS 0.7%