Lucene search

[email protected]CVE-2018-1202

HistoryMar 26, 2018 - 6:29 p.m.

CVE-2018-1202

2018-03-2618:29:01

CWE-79

[email protected]

web.nvd.nist.gov

dell

emc

isilon

ndmp

cross-site

scripting

vulnerability

onefs

web administration

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.0%

JSON

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the NDMP Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user’s browser session in the context of the OneFS website.

Affected configurations

NVD

Node

dellemc_isilonRange8.0.0.0–8.0.0.6

dellemc_isilonRange8.0.1.0–8.0.1.2

dellemc_isilonRange8.1.0.0–8.1.0.1

dellemc_isilonMatch7.1.1.11

CPENameOperatorVersion
dell:emc_isilondell emc isilonle8.0.0.6
dell:emc_isilondell emc isilonle8.0.1.2
dell:emc_isilondell emc isilonle8.1.0.1
dell:emc_isilondell emc isiloneq7.1.1.11

CPE	Name	Operator	Version
dell:emc_isilon	dell emc isilon	le	8.0.0.6
dell:emc_isilon	dell emc isilon	le	8.0.1.2
dell:emc_isilon	dell emc isilon	le	8.1.0.1
dell:emc_isilon	dell emc isilon	eq	7.1.1.11

CNA Affected

[
  {
    "product": "Isilon OneFS",
    "vendor": "Dell EMC",
    "versions": [
      {
        "status": "affected",
        "version": "versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, 8.0.0.0 - 8.0.0.6 and version 7.1.1.11"
      }
    ]
  }
]