CVE-2023-30564
Stored Cross-Site Scripting on Device Import Functionality
Alaris Systems Manager does not perform input validation during the Device Import Function.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Stored Cross-Site Scripting on Device Import Functionality
Alaris Systems Manager does not perform input validation during the Device Import Function.
- Record
CVE-2023-30564- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-34945
Alaris Systems Manager does not perform input validation during the Device Import Function.
- Record
EUVD-2023-34945- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89rw-4j9m-hp2w
Alaris Systems Manager does not perform input validation during the Device Import Function.
Alaris Systems Manager does not perform input validation during the Device Import Function.
- Record
GHSA-89rw-4j9m-hp2w- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Alaris Systems Manager does not perform input validation during the Device Import Function.
- Record
CVE-2023-30564- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-30564 is a medium vulnerability (CVSS 6.9) in Bd Alaris Systems Manager, published July 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.