Lucene search

MitreCVE-2018-5281

HistoryJan 08, 2018 - 9:29 a.m.

CVE-2018-5281

2018-01-0809:29:00

CWE-79

mitre

web.nvd.nist.gov

sonicwall

sonicos

xss

nsa

network security appliance

2017 q4

cfs custom category

cloud av db exclusion settings

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.0%

JSON

SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.

Affected configurations

Nvd

Node

sonicwallsonicos

AND

sonicwallnsa_250mMatch-

sonicwallnsa_2600Match-

sonicwallnsa_2650Match-

sonicwallnsa_3600Match-

sonicwallnsa_4600Match-

sonicwallnsa_5600Match-

sonicwallnsa_6600Match-

VendorProductVersionCPE
sonicwallsonicos*cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*
sonicwallnsa_250m-cpe:2.3:h:sonicwall:nsa_250m:-:*:*:*:*:*:*:*
sonicwallnsa_2600-cpe:2.3:h:sonicwall:nsa_2600:-:*:*:*:*:*:*:*
sonicwallnsa_2650-cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:*
sonicwallnsa_3600-cpe:2.3:h:sonicwall:nsa_3600:-:*:*:*:*:*:*:*
sonicwallnsa_4600-cpe:2.3:h:sonicwall:nsa_4600:-:*:*:*:*:*:*:*
sonicwallnsa_5600-cpe:2.3:h:sonicwall:nsa_5600:-:*:*:*:*:*:*:*
sonicwallnsa_6600-cpe:2.3:h:sonicwall:nsa_6600:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sonicwall	sonicos	*	cpe:2.3:o:sonicwall:sonicos::::::::
sonicwall	nsa_250m	-	cpe:2.3:h:sonicwall:nsa_250m:-:::::::*
sonicwall	nsa_2600	-	cpe:2.3:h:sonicwall:nsa_2600:-:::::::*
sonicwall	nsa_2650	-	cpe:2.3:h:sonicwall:nsa_2650:-:::::::*
sonicwall	nsa_3600	-	cpe:2.3:h:sonicwall:nsa_3600:-:::::::*
sonicwall	nsa_4600	-	cpe:2.3:h:sonicwall:nsa_4600:-:::::::*
sonicwall	nsa_5600	-	cpe:2.3:h:sonicwall:nsa_5600:-:::::::*
sonicwall	nsa_6600	-	cpe:2.3:h:sonicwall:nsa_6600:-:::::::*

References

www.securityfocus.com/bid/102443

psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0002

www.vulnerability-lab.com/get_content.php?id=1729

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.0%

JSON

Related for CVE-2018-5281