Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-9078

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.

Published

2018-09-28T20:29:01.097

Last Modified

2024-11-21T04:14:55.757

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System lenovo storcenter_px12-450r_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_px12-450r - No
Operating System lenovo storcenter_px12-400r_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_px12-400r - No
Operating System lenovo storcenter_px4-300r_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_px4-300r - No
Operating System lenovo storcenter_px6-300d_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_px6-300d - No
Operating System lenovo storcenter_px4-300d_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_px4-300d - No
Operating System lenovo storcenter_px2-300d_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_px2-300d - No
Operating System lenovo storcenter_ix4-300d_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_ix4-300d - No
Operating System lenovo storcenter_ix2_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_ix2 - No
Operating System lenovo storcenter_ix2-dl_firmware 4.1.402.34662 Yes
Hardware lenovo storcenter_ix2-dl - No
Operating System lenovo ez_media_\&_backup_center_firmware 4.1.402.34662 Yes
Hardware lenovo ez_media_\&_backup_center - No
Operating System lenovo px12-450r_firmware 4.1.402.34662 Yes
Hardware lenovo px12-450r - No
Operating System lenovo px12-400r_firmware 4.1.402.34662 Yes
Hardware lenovo px12-400r - No
Operating System lenovo px4-400r_firmware 4.1.402.34662 Yes
Hardware lenovo px4-400r - No
Operating System lenovo px4-300r_firmware 4.1.402.34662 Yes
Hardware lenovo px4-300r - No
Operating System lenovo px6-300d_firmware 4.1.402.34662 Yes
Hardware lenovo px6-300d - No
Operating System lenovo px4-400d_firmware 4.1.402.34662 Yes
Hardware lenovo px4-400d - No
Operating System lenovo px4-300d_firmware 4.1.402.34662 Yes
Hardware lenovo px4-300d - No
Operating System lenovo px2-300d_firmware 4.1.402.34662 Yes
Hardware lenovo px2-300d - No
Operating System lenovo ix4-300d_firmware 4.1.402.34662 Yes
Hardware lenovo ix4-300d - No
Operating System lenovo ix2_firmware 4.1.402.34662 Yes
Hardware lenovo ix2 - No
Operating System lenovo ez_media_\&_backup_center_firmware 4.1.402.34662 Yes
Hardware lenovo ez_media_\&_backup_center - No
References