{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T19:14:04.843","vulnerabilities":[{"cve":{"id":"CVE-2023-40461","sourceIdentifier":"security@sierrawireless.com","published":"2023-12-04T23:15:25.397","lastModified":"2024-11-21T08:19:31.120","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"\n\n\n\n\n\n\n\n\n\nThe ACEManager\ncomponent of ALEOS 4.16 and earlier allows an\n\n\n\nauthenticated user\nwith Administrator privileges to access a file\n\n\n\nupload field which\ndoes not fully validate the file name, creating a\n\n\n\nStored Cross-Site\nScripting condition.\n\n\n\n\n\n\n\n"},{"lang":"es","value":"El componente ACEManager de ALEOS 4.16 y versiones anteriores permite que un usuario autenticado con privilegios de administrador acceda a un campo de carga de archivos que no valida completamente el nombre del archivo, creando una condición de Cross-Site Scripting Almacenado."}],"metrics":{"cvssMetricV31":[{"source":"security@sierrawireless.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}]},"weaknesses":[{"source":"security@sierrawireless.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sierrawireless:aleos:*:*:*:*:*:*:*:*","versionEndIncluding":"4.16.0","matchCriteriaId":"45265DDA-E10F-49D0-B2C6-FC123C42E5AE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:es450:-:*:*:*:*:*:*:*","matchCriteriaId":"524DF1AE-21F2-4AA6-99E7-6F98304FF845"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:gx450:-:*:*:*:*:*:*:*","matchCriteriaId":"2C12CF71-FE0E-44EA-9F2E-7CFB42E7C216"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:lx40:-:*:*:*:*:*:*:*","matchCriteriaId":"069DD303-C100-4FAF-BD6B-4EE61CBDE9F7"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:lx60:-:*:*:*:*:*:*:*","matchCriteriaId":"2A3B7B3D-1594-434B-8E22-01C67DF54F16"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:mp70:-:*:*:*:*:*:*:*","matchCriteriaId":"007D4629-4BE2-4C7A-AC8B-E87739E22D12"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:rv50x:-:*:*:*:*:*:*:*","matchCriteriaId":"61D3EF27-E823-4E49-BD58-D050EB02D294"},{"vulnerable":false,"criteria":"cpe:2.3:h:sierrawireless:rv55:-:*:*:*:*:*:*:*","matchCriteriaId":"215BD4AB-8EFD-4F82-ABE4-E7F81AD528C2"}]}]}],"references":[{"url":"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs","source":"security@sierrawireless.com","tags":["Vendor Advisory"]},{"url":"https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-006/#sthash.6KUVtE6w.dpbs","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}