CVE-2021-23856 — CRITICAL (10.0)

Vulnerability Description

The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Bosch	Rexroth Indramotion Mlc L20 Firmware	-
Bosch	Rexroth Indramotion Mlc L20	-
Bosch	Rexroth Indramotion Mlc L40 Firmware	-
Bosch	Rexroth Indramotion Mlc L40	-

Related Weaknesses (CWE)

CWE-79

References

https://psirt.bosch.com/security-advisories/bosch-sa-741752.htmlVendor Advisory
https://psirt.bosch.com/security-advisories/bosch-sa-741752.htmlVendor Advisory

FAQ

What is CVE-2021-23856?

CVE-2021-23856 is a vulnerability with a CVSS score of 10.0 (CRITICAL). The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.

How severe is CVE-2021-23856?

CVE-2021-23856 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-23856?

Check the references section above for vendor advisories and patch information. Affected products include: Bosch Rexroth Indramotion Mlc L20 Firmware, Bosch Rexroth Indramotion Mlc L20, Bosch Rexroth Indramotion Mlc L40 Firmware, Bosch Rexroth Indramotion Mlc L40.