Details of VAR-201809-1099

ID

VAR-201809-1099

CVE

CVE-2018-9081

TITLE

plural Lenovo Product site cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-010432

DESCRIPTION

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger. Iomega , Lenovo , LenovoEMC NAS The device contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Lenovo Iomega StorCenter px12-450r and others are all storage devices of China Lenovo (Lenovo). A cross-site scripting vulnerability exists in the Web UI of several Lenovo products using firmware 4.1.402.34662 and earlier. A remote attacker could exploit this vulnerability to elevate privileges by adding a file. The following products and versions are affected: Lenovo Iomega StorCenter px12-450r, StorCenter px12-400r, StorCenter px4-300r, StorCenter px6-300d, StorCenter px4-300d, StorCenter px2-300d, StorCenter ix4-300d, StorCenter ix2/ix2-dl , EZ Media & Backup Center; LenovoEMC px12-450r, px12-400r, px4-400r, px4-300r, px6-300d, px4-400d, px4-300d, px2-300d; Lenovo ix4-300d, ix2, EZ Media & Backup Center

Trust: 1.71

sources: NVD: CVE-2018-9081 // JVNDB: JVNDB-2018-010432 // VULHUB: VHN-139113

AFFECTED PRODUCTS

vendor:	lenovo	model:	storcenter px12-400r	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter px4-300r	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter px2-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter ix4-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter px12-450r	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter px4-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	ez media \& backup center	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter px6-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter ix2	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	storcenter ix2-dl	scope:	eq	version:	4.1.402.34662	Trust: 1.6
vendor:	lenovo	model:	ix4-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px12-450r	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px4-400r	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px4-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px12-400r	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px4-400d	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	ix2	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px6-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px2-300d	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	px4-300r	scope:	eq	version:	4.1.402.34662	Trust: 1.0
vendor:	lenovo	model:	lenovoemc	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2018-010432 // CNNVD: CNNVD-201809-1180 // NVD: CVE-2018-9081

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-9081
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-9081
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201809-1180
value:	LOW
Trust: 0.6
VULHUB:	VHN-139113
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2018-9081
severity:	LOW
baseScore:	2.6
vectorString:	AV:N/AC:H/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	4.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-139113
severity:	LOW
baseScore:	2.6
vectorString:	AV:N/AC:H/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	4.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-9081
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.6
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-139113 // JVNDB: JVNDB-2018-010432 // CNNVD: CNNVD-201809-1180 // NVD: CVE-2018-9081

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-139113 // JVNDB: JVNDB-2018-010432 // NVD: CVE-2018-9081

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-1180

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201809-1180

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-010432

PATCH

title:	LEN-24224	url:	https://support.lenovo.com/jp/ja/solutions/len-24224	Trust: 0.8
title:	Multiple Lenovo Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85214	Trust: 0.6

sources: JVNDB: JVNDB-2018-010432 // CNNVD: CNNVD-201809-1180

EXTERNAL IDS

db:	NVD	id:	CVE-2018-9081	Trust: 2.5
db:	LENOVO	id:	LEN-24224	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-010432	Trust: 0.8
db:	CNNVD	id:	CNNVD-201809-1180	Trust: 0.7
db:	VULHUB	id:	VHN-139113	Trust: 0.1

sources: VULHUB: VHN-139113 // JVNDB: JVNDB-2018-010432 // CNNVD: CNNVD-201809-1180 // NVD: CVE-2018-9081

REFERENCES

url:	https://support.lenovo.com/us/en/solutions/len-24224	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-9081	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-9081	Trust: 0.8

sources: VULHUB: VHN-139113 // JVNDB: JVNDB-2018-010432 // CNNVD: CNNVD-201809-1180 // NVD: CVE-2018-9081

SOURCES

db:	VULHUB	id:	VHN-139113
db:	JVNDB	id:	JVNDB-2018-010432
db:	CNNVD	id:	CNNVD-201809-1180
db:	NVD	id:	CVE-2018-9081

LAST UPDATE DATE

2024-11-23T22:00:17.248000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-139113	date:	2018-11-16T00:00:00
db:	JVNDB	id:	JVNDB-2018-010432	date:	2018-12-14T00:00:00
db:	CNNVD	id:	CNNVD-201809-1180	date:	2018-09-30T00:00:00
db:	NVD	id:	CVE-2018-9081	date:	2024-11-21T04:14:56.240

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-139113	date:	2018-09-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-010432	date:	2018-12-14T00:00:00
db:	CNNVD	id:	CNNVD-201809-1180	date:	2018-09-27T00:00:00
db:	NVD	id:	CVE-2018-9081	date:	2018-09-28T20:29:01.423