Lucene search

[email protected]CVE-2018-9079

HistorySep 28, 2018 - 8:29 p.m.

CVE-2018-9079

2018-09-2820:29:01

CWE-79

[email protected]

web.nvd.nist.gov

cve-2018-9079

iomega

lenovo

lenovoemc

nas devices

vulnerability

dom

html

javascript

security

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.

Affected configurations

NVD

Node

lenovostorcenter_px12-450rMatch-

AND

lenovostorcenter_px12-450r_firmwareMatch4.1.402.34662

Node

lenovostorcenter_px12-400r_firmwareMatch4.1.402.34662

AND

lenovostorcenter_px12-400rMatch-

Node

lenovostorcenter_px4-300rMatch-

AND

lenovostorcenter_px4-300r_firmwareMatch4.1.402.34662

Node

lenovostorcenter_px6-300dMatch-

AND

lenovostorcenter_px6-300d_firmwareMatch4.1.402.34662

Node

lenovostorcenter_px4-300dMatch-

AND

lenovostorcenter_px4-300d_firmwareMatch4.1.402.34662

Node

lenovostorcenter_px2-300dMatch-

AND

lenovostorcenter_px2-300d_firmwareMatch4.1.402.34662

Node

lenovostorcenter_ix4-300d_firmwareMatch4.1.402.34662

AND

lenovostorcenter_ix4-300dMatch-

Node

lenovostorcenter_ix2_firmwareMatch4.1.402.34662

AND

lenovostorcenter_ix2Match-

Node

lenovostorcenter_ix2-dlMatch-

AND

lenovostorcenter_ix2-dl_firmwareMatch4.1.402.34662

Node

lenovoez_media_\&_backup_centerMatch-

AND

lenovoez_media_\&_backup_center_firmwareMatch4.1.402.34662

Node

lenovopx12-450r_firmwareMatch4.1.402.34662

AND

lenovopx12-450rMatch-

Node

lenovopx12-400r_firmwareMatch4.1.402.34662

AND

lenovopx12-400rMatch-

Node

lenovopx4-400r_firmwareMatch4.1.402.34662

AND

lenovopx4-400rMatch-

Node

lenovopx4-300r_firmwareMatch4.1.402.34662

AND

lenovopx4-300rMatch-

Node

lenovopx6-300d_firmwareMatch4.1.402.34662

AND

lenovopx6-300dMatch-

Node

lenovopx4-400d_firmwareMatch4.1.402.34662

AND

lenovopx4-400dMatch-

Node

lenovopx4-300d_firmwareMatch4.1.402.34662

AND

lenovopx4-300dMatch-

Node

lenovopx2-300d_firmwareMatch4.1.402.34662

AND

lenovopx2-300dMatch-

Node

lenovoix4-300d_firmwareMatch4.1.402.34662

AND

lenovoix4-300dMatch-

Node

lenovoix2_firmwareMatch4.1.402.34662

AND

lenovoix2Match-

Node

lenovoez_media_\&_backup_center_firmwareMatch4.1.402.34662

AND

lenovoez_media_\&_backup_centerMatch-

CPENameOperatorVersion
lenovo:storcenter_px12-450r_firmwarelenovo storcenter px12-450r firmwareeq4.1.402.34662

CPE	Name	Operator	Version
lenovo:storcenter_px12-450r_firmware	lenovo storcenter px12-450r firmware	eq	4.1.402.34662

CNA Affected

[
  {
    "product": "Iomega StorCenter",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "LenovoEMC",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "EZ Media and Backup Center",
    "vendor": "Lenovo Group LTD",
    "versions": [
      {
        "lessThanOrEqual": "4.1.402.34662",
        "status": "affected",
        "version": "4.1.402.34662",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/solutions/LEN-24224

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

Related for CVE-2018-9079

prion1 cvelist1 nvd1 lenovo2 threatpost1