Lucene search

[email protected]CVE-2018-1188

HistoryMar 26, 2018 - 6:29 p.m.

CVE-2018-1188

2018-03-2618:29:01

CWE-79

[email protected]

web.nvd.nist.gov

dell emc

isilon

onefs

xss

vulnerability

authorization providers

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.0%

JSON

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user’s browser session in the context of the OneFS website.

Affected configurations

NVD

Node

dellemc_isilonRange7.2.1.0–7.2.1.6

dellemc_isilonRange8.0.0.0–8.0.0.6

dellemc_isilonRange8.0.1.0–8.0.1.2

dellemc_isilonRange8.1.0.0–8.1.0.1

CPENameOperatorVersion
dell:emc_isilondell emc isilonle7.2.1.6
dell:emc_isilondell emc isilonle8.0.0.6
dell:emc_isilondell emc isilonle8.0.1.2
dell:emc_isilondell emc isilonle8.1.0.1

CPE	Name	Operator	Version
dell:emc_isilon	dell emc isilon	le	7.2.1.6
dell:emc_isilon	dell emc isilon	le	8.0.0.6
dell:emc_isilon	dell emc isilon	le	8.0.1.2
dell:emc_isilon	dell emc isilon	le	8.1.0.1

CNA Affected

[
  {
    "product": "Isilon OneFS",
    "vendor": "Dell EMC",
    "versions": [
      {
        "status": "affected",
        "version": "versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, 8.0.0.0 - 8.0.0.6, versions 7.2.1.x"
      }
    ]
  }
]