What is the CVSS score of CVE-2018-9081?

CVE-2018-9081 has a CVSS 3.0 base score of 4.7 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.5%.

Storcenter Px12 450R Firmware CVE-2018-9081

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2018-09-28 psirt@lenovo.com

Lenovo XSS Storcenter Px12 450R Firmware Storcenter Px12 400R Firmware Storcenter Px4 300R Firmware Storcenter Px6 300D Firmware Storcenter Px4 300D Firmware Storcenter Px2 300D Firmware Storcenter Ix4 300D Firmware Storcenter Ix2 Firmware Storcenter Ix2 Dl Firmware Ez Media Backup Center Firmware Px12 450R Firmware Px12 400R Firmware Px4 400R Firmware Px4 300R Firmware Px6 300D Firmware Px4 400D Firmware Px4 300D Firmware Px2 300D Firmware Ix4 300D Firmware Ix2 Firmware

4.7

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Sep 28, 2018 - 20:29 nvd

MEDIUM 4.7

DescriptionNVD

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.

AnalysisAI

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger. Affected products include: Lenovo Storcenter Px12-450R Firmware, Lenovo Storcenter Px12-400R Firmware, Lenovo Storcenter Px4-300R Firmware, Lenovo Storcenter Px6-300D Firmware, Lenovo Storcenter Px4-300D Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.