Lucene search

[email protected]CVE-2018-18985

HistoryJan 29, 2019 - 4:29 p.m.

CVE-2018-18985

2019-01-2916:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-18985

tridium

niagara

enterprise security

cross-site scripting

vulnerability

nvd

confidentiality

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.

Affected configurations

NVD

Node

tridiumniagaraRange<4.4.93.40.2

tridiumniagaraRange4.6–4.6.96.28.4

tridiumniagaraMatch4.4u2

tridiumniagara_ax_frameworkRange<3.8.401.1

tridiumniagara_ax_frameworkMatch3.8u4

tridiumniagara_enterprise_securityRange<2.3.118.6

tridiumniagara_enterprise_securityMatch2.3u1

CPENameOperatorVersion
tridium:niagaratridium niagaralt4.4.93.40.2
tridium:niagaratridium niagaralt4.6.96.28.4
tridium:niagaratridium niagaraeq4.4u2
tridium:niagara_ax_frameworktridium niagara ax frameworklt3.8.401.1
tridium:niagara_ax_frameworktridium niagara ax frameworkeq3.8u4
tridium:niagara_enterprise_securitytridium niagara enterprise securitylt2.3.118.6
tridium:niagara_enterprise_securitytridium niagara enterprise securityeq2.3u1

CPE	Name	Operator	Version
tridium:niagara	tridium niagara	lt	4.4.93.40.2
tridium:niagara	tridium niagara	lt	4.6.96.28.4
tridium:niagara	tridium niagara	eq	4.4u2
tridium:niagara_ax_framework	tridium niagara ax framework	lt	3.8.401.1
tridium:niagara_ax_framework	tridium niagara ax framework	eq	3.8u4
tridium:niagara_enterprise_security	tridium niagara enterprise security	lt	2.3.118.6
tridium:niagara_enterprise_security	tridium niagara enterprise security	eq	2.3u1

CNA Affected

[
  {
    "product": "Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4",
    "vendor": "Tridium",
    "versions": [
      {
        "status": "affected",
        "version": "Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4"
      }
    ]
  }
]

References

www.securityfocus.com/bid/106530

ics-cert.us-cert.gov/advisories/ICSA-18-333-02

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

Related for CVE-2018-18985

nvd1 nessus2 cvelist1 ics1 prion1