CVE-2023-33276
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The web interface of Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 is vulnerable to reflective XSS attacks. It responds with a '404 - Not Found' status code for non-existent paths, but the value of the path is reflected in the response.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to implement context-sensitive HTML encoding for path values in responses and to update the software to the latest version.
Original NVD description (English source)
The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is accessed that does not exist. However, the value of the path is reflected in the response. As the application will reflect the supplied path without context-sensitive HTML encoding, it is vulnerable to reflective cross-site scripting (XSS).