PT-2019-8889 · Seagate · Seagate Nas Os

Publicado 2019-05-13 · Atualizado 2019-05-13 · CVE-2018-12302

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue concerns a missing HTTPOnly flag on session cookies in the web application of Seagate NAS OS, which allows attackers to steal session tokens via cross-site scripting.

Recommendations For Seagate NAS OS version 4.3.15.1, consider updating the web application to include the HTTPOnly flag on session cookies to prevent session token theft.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-12302

Produtos afetados

Seagate Nas Os

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-12302 · Aviso do Fabricante
• https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12302 · Nota de Segurança