CVE-2021-23860: Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS
An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-23860?
CVE-2021-23860 is a vulnerability in the VRM (Video Recording Manager) and the web-based interface of Bosch Video Management System (BVMS) that may lead to a reflected cross-site scripting (XSS) attack.
How does CVE-2021-23860 affect Bosch Video Management System (BVMS)?
CVE-2021-23860 affects installations of BVMS versions 9.0 to 11.0, allowing an attacker to exploit a page handler error in the VRM and perform a reflected XSS attack through the web-based interface.
Can CVE-2021-23860 be exploited remotely?
Yes, CVE-2021-23860 can be exploited remotely if the attacker is able to modify the HTTP header that is sent.
Is Bosch Divar IP firmware affected by CVE-2021-23860?
No, Bosch Divar IP 5000 and 7000 firmware are not vulnerable to CVE-2021-23860.
How severe is CVE-2021-23860?
CVE-2021-23860 has a severity score of 6.1 (Medium).