8.8

CVE-2018-9078

Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Storcenter Px12-450r Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Px12-450r Version -
Lenovo ≫ Storcenter Px12-400r Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Px12-400r Version -
Lenovo ≫ Storcenter Px4-300r Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Px4-300r Version -
Lenovo ≫ Storcenter Px6-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Px6-300d Version -
Lenovo ≫ Storcenter Px4-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Px4-300d Version -
Lenovo ≫ Storcenter Px2-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Px2-300d Version -
Lenovo ≫ Storcenter Ix4-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Ix4-300d Version -
Lenovo ≫ Storcenter Ix2 Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Ix2 Version -
Lenovo ≫ Storcenter Ix2-dl Firmware Version 4.1.402.34662
   Lenovo ≫ Storcenter Ix2-dl Version -
Lenovo ≫ Ez Media & Backup Center Firmware Version 4.1.402.34662
   Lenovo ≫ Ez Media & Backup Center Version -
Lenovo ≫ Px12-450r Firmware Version 4.1.402.34662
   Lenovo ≫ Px12-450r Version -
Lenovo ≫ Px12-400r Firmware Version 4.1.402.34662
   Lenovo ≫ Px12-400r Version -
Lenovo ≫ Px4-400r Firmware Version 4.1.402.34662
   Lenovo ≫ Px4-400r Version -
Lenovo ≫ Px4-300r Firmware Version 4.1.402.34662
   Lenovo ≫ Px4-300r Version -
Lenovo ≫ Px6-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Px6-300d Version -
Lenovo ≫ Px4-400d Firmware Version 4.1.402.34662
   Lenovo ≫ Px4-400d Version -
Lenovo ≫ Px4-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Px4-300d Version -
Lenovo ≫ Px2-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Px2-300d Version -
Lenovo ≫ Ix4-300d Firmware Version 4.1.402.34662
   Lenovo ≫ Ix4-300d Version -
Lenovo ≫ Ix2 Firmware Version 4.1.402.34662
   Lenovo ≫ Ix2 Version -
Lenovo ≫ Ez Media & Backup Center Firmware Version 4.1.402.34662
   Lenovo ≫ Ez Media & Backup Center Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.04% 0.595
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://support.lenovo.com/us/en/solutions/LEN-24224
Vendor Advisory