PT-2019-8887 · Seagate · Seagate Nas Os

Publicado 2019-05-13 · Atualizado 2019-05-13 · CVE-2018-12300

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue allows attackers to disclose information in the Referer header via the 'state' URL parameter in echo-server.html. This is due to an arbitrary redirect in the affected software.

Recommendations For Seagate NAS OS version 4.3.15.1, avoid using the state URL parameter in the affected echo-server.html until the issue is resolved. As a temporary workaround, consider restricting access to the echo-server.html page to minimize the risk of exploitation.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-12300

Produtos afetados

Seagate Nas Os

Referências · 3

• 🔥 https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12300 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12300 · Aviso do Fabricante