Lucene search

[email protected]CVE-2018-19694

HistoryMar 21, 2019 - 4:00 p.m.

CVE-2018-19694

2019-03-2116:00:32

CWE-79

[email protected]

web.nvd.nist.gov

hms

netbiter

ws100

3.30.5

xss

reflected xss

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON

HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.

Affected configurations

NVD

Node

hms-networksnetbiter_ws100Match-

AND

hms-networksnetbiter_ws100_firmwareRange≤3.30.5

Node

hms-networksnetbiter_ws200Match-

AND

hms-networksnetbiter_ws200_firmwareRange≤3.30.4

Node

hms-networksnetbiter_ec150Match-

AND

hms-networksnetbiter_ec150_firmwareRange≤1.40.0

Node

hms-networksnetbiter_ec250Match-

AND

hms-networksnetbiter_ec250_firmwareRange≤1.40.0

Node

hms-networksnetbiter_lc310Match-

AND

hms-networksnetbiter_lc310_firmwareRange≤3.30.5

Node

hms-networksnetbiter_lc310_thingworxMatch-

AND

hms-networksnetbiter_lc310_thingworx_firmwareRange≤2.00.07

Node

hms-networksnetbiter_lc350Match-

AND

hms-networksnetbiter_lc350_firmwareRange≤2.00.07

Node

hms-networksnetbiter_lc350_thingworxMatch-

AND

hms-networksnetbiter_lc350_thingworx_firmwareRange≤2.00.07

CPENameOperatorVersion
hms-networks:netbiter_ws100_firmwarehms-networks netbiter ws100 firmwarele3.30.5

CPE	Name	Operator	Version
hms-networks:netbiter_ws100_firmware	hms-networks netbiter ws100 firmware	le	3.30.5

References

packetstormsecurity.com/files/151119/HMS-Netbiter-WS100-3.30.5-Cross-Site-Scripting.html

seclists.org/bugtraq/2019/Jan/9

www.hms-networks.com/docs/librariesprovider6/cybersecurity/hms-security-advisory-2018-12-04-001-ec150-ec250-lc310-lc350-ws100-ws200-cve-2018-19694.pdf

www.netbiter.com/products

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON

Related for CVE-2018-19694

packetstorm1 cvelist1 prion1 nvd1