PT-2019-8891 · Seagate · Seagate Nas Os

Publicado 2019-05-13 · Atualizado 2019-05-13 · CVE-2018-12304

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue concerns cross-site scripting in the Application Manager. Attackers can execute JavaScript via multiple application metadata fields, including Short Description, Publisher Name, Publisher Contact, or Website URL.

Recommendations For Seagate NAS OS version 4.3.15.1, avoid using the vulnerable metadata fields until a patch is available. As a temporary workaround, consider restricting access to the Application Manager to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-12304

Produtos afetados

Seagate Nas Os

Referências · 3

• 🔥 https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12304 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12304 · Aviso do Fabricante