4.7med
CVE-2018-6492
MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations Management (NOM) Suite, Multiple Vulnerabilities
Published 8 y ago · modified 4 mo ago · JSON
CVSS
4.7
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 75%
Public exploits
0
none known
Summary
Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow persistent cross-site scripting, and non-persistent HTML Injection.
Exploit prediction (EPSS)
1.52% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 4.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.0 | 4.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Micro Focus Network Operations Management Ultimate
- Micro Focus Network Automation
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- softwaresupport.softwaregrp.com /document/-/facetsearch/document/KM03158014 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1040900 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/104131 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-6492
- NVD: CVE-2018-6492
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.