CVE-2018-9081

Iomega and LenovoEMC NAS Web UI Vulnerabilities

published September 28, 2018

CVSS
—
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Published
2018-09-28T20:00Z
EPSS history
Timeline
  • 28 SEP 20:00Z
    Iomega and LenovoEMC NAS Web UI Vulnerabilities
    cvelistv5