vulnwire
5.4med

CVE-2018-1155

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript co…

Published 8 y ago · modified 2 mo ago · JSON

CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

  • Tenable SecurityCenter

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • tenable.com /security/tns-2018-11 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1041431 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.