XSS in Bosch Praesensa
CVE-2020-6777
A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an authenticated remote attacker with admin privileges to mount a stored Cross-Site-Scripting (XSS) attack against another user. When the victim logs into the management interface, the stored script code is executed in the context of his browser. A successful exploit would allow an attacker to interact with the management interface with the privileges of the victim. However, as the attacker already needs admin privileges, there is no additional impact on the management interface itself.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.006 (47.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 47.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Bosch Praesensa — versions <= 1.10
- Bosch Praesensa Firmware
- Bosch Praesideo — versions <= 4.41
- Bosch Praesideo Firmware
Weakness classification (CWE)
References
- psirt.bosch.com/security-advisories/bosch-sa-538331-bt.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-6777?
- CVE-2020-6777 is a medium-severity vulnerability in Bosch Praesensa, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2021-01-14.
- How severe is CVE-2020-6777?
- Medium severity. CVSS v3 base score is 4.8 out of 10.