What is CVE-2023-4667?

CVE-2023-4667 is a high-severity vulnerability in Idemia Morphowave Compact, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2023-11-28.

How severe is CVE-2023-4667?

High severity. CVSS v3 base score is 8.1 out of 10.

XSS in Idemia Morphowave Compact

CVE-2023-4667

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N.

Affected products

Idemia Morphowave_compact
Idemia Morphowave_compact_firmware
Idemia Morphowave Compact/xp — versions 0
Idemia Morphowave Sp — versions 0
Idemia Morphowave_sp
Idemia Morphowave_sp_firmware
Idemia Sgima_lite_\&_lite\+
Idemia Sgima_lite_\&_lite\+_firmware
Idemia Sigma Extreme — versions 0
Idemia Sigma_extreme

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

a87f365f-9d39-4848-9b3a-58c7cae69cab (Vendor Advisory)

Frequently asked questions

What is CVE-2023-4667?: CVE-2023-4667 is a high-severity vulnerability in Idemia Morphowave Compact, classified under Cross-site Scripting. CVSS score: 8.1/10. Published 2023-11-28.
How severe is CVE-2023-4667?: High severity. CVSS v3 base score is 8.1 out of 10.