There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version.

Published 8 y ago 2018-06-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.4%

percentile 38%

Public exploits

none known

There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system and perform a XSS attack. A successful exploit could cause the eSpace Desktop to hang up, and the function will restore to normal after restarting the eSpace Desktop.

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.4	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:N/I:P/A:N`

Affected products

Huawei Technologies Co., Ltd. eSpace Desktop

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

huawei.com /en/psirt/security-advisories/huawei-sa-20180530-01-xss-en · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-7976
NVD: CVE-2018-7976

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.