title: Stored Cross Site Scripting in webserver administration
description:
The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface.
The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.
This could lead to  unauthorized access and data leakage
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
defaultStatus: unaffected
product: SIGMA Lite & Lite +
vendor: IDEMIA
versions:
status: affected, version: 0
}
{
defaultStatus: unaffected
product: SIGMA Wide
vendor: IDEMIA
versions:
status: affected, version: 0
}
{
defaultStatus: unaffected
product: SIGMA Extreme
vendor: IDEMIA
versions:
status: affected, version: 0
}
{
defaultStatus: unaffected
product: MorphoWave Compact/XP
vendor: IDEMIA
versions:
status: affected, version: 0
}
{
defaultStatus: unaffected
product: VisionPass
vendor: IDEMIA
versions:
status: affected, version: 0
}
{
defaultStatus: unaffected
product: MorphoWave SP
vendor: IDEMIA
versions:
status: affected, version: 0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL