5.4

CVE-2018-5281

Exploit
SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonicwall ≫ Sonicos
   Sonicwall ≫ Nsa 250m Version-
   Sonicwall ≫ Nsa 2600 Version-
   Sonicwall ≫ Nsa 2650 Version-
   Sonicwall ≫ Nsa 3600 Version-
   Sonicwall ≫ Nsa 4600 Version-
   Sonicwall ≫ Nsa 5600 Version-
   Sonicwall ≫ Nsa 6600 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.561
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.securityfocus.com/bid/102443
Third Party Advisory
VDB Entry