{"id":"CVE-2023-4667","aliases":["EUVD-2023-54519","GHSA-5585-c8pm-rcfv"],"status":"published","title":"Stored Cross Site Scripting in webserver administration","description":"The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. \n\n\n\nThe root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.\n\nThis could lead to  unauthorized access and data leakage","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00421,"percentile":0.36687,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-11-28T08:09:10Z","modified":"2026-06-17T06:38:19Z","products":[{"vendor":"idemia","product":"morphowave compact/xp"},{"vendor":"idemia","product":"morphowave sp"},{"vendor":"idemia","product":"morphowave_compact_firmware"},{"vendor":"idemia","product":"morphowave_sp_firmware"},{"vendor":"idemia","product":"sgima_lite_\\\u0026_lite\\+_firmware"},{"vendor":"idemia","product":"sigma extreme"},{"vendor":"idemia","product":"sigma lite \u0026 lite +"},{"vendor":"idemia","product":"sigma wide"},{"vendor":"idemia","product":"sigma_extreme_firmware"},{"vendor":"idemia","product":"sigma_wide_firmware"},{"vendor":"idemia","product":"visionpass"},{"vendor":"idemia","product":"visionpass_firmware"}],"references":[{"url":"https://www.idemia.com/vulnerability-information","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4667"},{"url":"https://github.com/advisories/GHSA-5585-c8pm-rcfv"}],"sources":{"cve":[{"id":"CVE-2023-4667","title":"Stored Cross Site Scripting in webserver administration","description":"\nThe web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. \n\n\n\nThe root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.\n\nThis could lead to  unauthorized access and data leakage\n\n\n\n","status":"published","published":"2023-11-28T08:09:10.45Z","modified":"2024-10-17T16:26:43.231Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-54519","description":"\nThe web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. \n\n\n\nThe root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.\n\nThis could lead to  unauthorized access and data leakage\n\n\n\n","status":"published","published":"2023-11-28T08:09:10Z","modified":"2024-10-17T16:26:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:33.799805Z"}],"ghsa":[{"id":"GHSA-5585-c8pm-rcfv","title":"\nThe web interface of the PAC Device allows the device administrator user profile to store...","description":"\nThe web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. \n\n\n\nThe root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.\n\nThis could lead to  unauthorized access and data leakage\n\n\n\n","status":"published","published":"2023-11-28T09:30:27Z","modified":"2023-11-28T09:30:32Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:06.860566Z"}],"nvd":[{"id":"CVE-2023-4667","description":"\nThe web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. \n\n\n\nThe root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.\n\nThis could lead to  unauthorized access and data leakage\n\n\n\n","status":"published","published":"2023-11-28T09:15:07.467Z","modified":"2026-06-17T06:38:19.72Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:49.393375Z"}]}}