Lucene search

[email protected]CVE-2018-9078

HistorySep 28, 2018 - 8:29 p.m.

CVE-2018-9078

2018-09-2820:29:01

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-9078

iomega

lenovo

lenovoemc

nas devices

content explorer

svg

javascript

security vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device’s origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.

Affected configurations

NVD

Node

lenovostorcenter_px12-450r_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px12-450rMatch-

Node

lenovostorcenter_px12-400r_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px12-400rMatch-

Node

lenovostorcenter_px4-300r_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px4-300rMatch-

Node

lenovostorcenter_px6-300d_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px6-300dMatch-

Node

lenovostorcenter_px4-300d_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px4-300dMatch-

Node

lenovostorcenter_px2-300d_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px2-300dMatch-

Node

lenovostorcenter_ix4-300d_firmwareMatch4.1.402.34662

AND

lenovostorcenter_ix4-300dMatch-

Node

lenovostorcenter_ix2_firmwareMatch4.1.402.34662

AND

lenovostorcenter_ix2Match-

Node

lenovostorcenter_ix2-dl_firmwareMatch4.1.402.34662

AND

lenovostorcenter_ix2-dlMatch-

Node

lenovoez_media_\&_backup_center_firmwareMatch4.1.402.34662

AND

lenovoez_media_\&_backup_centerMatch-

Node

lenovopx12-450r_firmwareMatch4.1.402.34662

AND

lenovopx12-450rMatch-

Node

lenovopx12-400r_firmwareMatch4.1.402.34662

AND

lenovopx12-400rMatch-

Node

lenovopx4-400r_firmwareMatch4.1.402.34662

AND

lenovopx4-400rMatch-

Node

lenovopx4-300r_firmwareMatch4.1.402.34662

AND

lenovopx4-300rMatch-

Node

lenovopx6-300d_firmwareMatch4.1.402.34662

AND

lenovopx6-300dMatch-

Node

lenovopx4-400d_firmwareMatch4.1.402.34662

AND

lenovopx4-400dMatch-

Node

lenovopx4-300d_firmwareMatch4.1.402.34662

AND

lenovopx4-300dMatch-

Node

lenovopx2-300d_firmwareMatch4.1.402.34662

AND

lenovopx2-300dMatch-

Node

lenovoix4-300d_firmwareMatch4.1.402.34662

AND

lenovoix4-300dMatch-

Node

lenovoix2_firmwareMatch4.1.402.34662

AND

lenovoix2Match-

Node

lenovoez_media_\&_backup_center_firmwareMatch4.1.402.34662

AND

lenovoez_media_\&_backup_centerMatch-

CPENameOperatorVersion
lenovo:storcenter_px12-450r_firmwarelenovo storcenter px12-450r firmwareeq4.1.402.34662

CPE	Name	Operator	Version
lenovo:storcenter_px12-450r_firmware	lenovo storcenter px12-450r firmware	eq	4.1.402.34662

CNA Affected

[
  {
    "product": "Iomega StorCenter",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LenovoEMC",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "EZ Media and Backup Center",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/solutions/LEN-24224

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

Related for CVE-2018-9078

prion1 cvelist1 nvd1 lenovo2 threatpost1