CVE-2018-1155CWE-79cross-site-scripting

CVE-2018-1155

Medium · published August 2, 2018

CVSS v3.0
5.4
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00573 · 46.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-08-02T23:29Z
Affected products (1)
ProductVersionsFixed in
tenable/security_center< 5.7.05.7.0
References (4)
http://www.securitytracker.com/id/1041431 · [email protected]https://www.tenable.com/security/tns-2018-11 · [email protected]http://www.securitytracker.com/id/1041431 · af854a3a-2127-422b-91ae-364da2661108https://www.tenable.com/security/tns-2018-11 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 AUG 19:00Z
    In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image…
    cvelistv5