Intel® RAID Web Console 3 Cross-site Scripting Vulnerability Advisory

Summary:

A potential security vulnerability in the Intel® RAID Web Console (RWC) may allow remote manipulation of RWC console output.** **Intel is releasing RAID Web Console updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-3699

Description: Cross-site scripting in the Intel® RAID Web Console v3 for Windows* may allow an unauthenticated user to elevate privilege via remote access.

CVSS Base Score: 3.8 Low

CVSS Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Affected Products:

Intel® RAID Web Console v3 before 4.186.

Recommendations:

Intel recommends that users of Intel® RAID Web Console update to 4.186 or later.

Updates are available for download at this location: <https://downloadcenter.intel.com/download/28183/Intel-RAID-Web-Console-3-for-Windows-?wapkw=rwc3&gt;

Acknowledgements:

Intel would like to thank Joe Standing for reporting this issue and working with us on coordinated disclosure.