PT-2018-16861 · Sonicwall · Sonicos

Benjamin K.M · Published 2018-01-08 · Updated 2024-06-15 · CVE-2018-5280

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices

Description The issue is related to a Cross-Site Scripting (XSS) vulnerability, which occurs via the Configure SSO screens. This allows for potential malicious script execution.

Recommendations For SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices, consider disabling access to the Configure SSO screens as a temporary workaround until a fix is available. Restricting user input in these screens can also help minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-5280

OPENSUSE-SU-2024:11290-1

Affected Products

Sonicos

References · 19

• 🔥 https://vulnerability-lab.com/get_content.php?id=1725 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-5280 · Security Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0001 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11290-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5280 · Vendor Advisory
• https://suse.com/security/cve/CVE-2007-1995 · Note
• https://suse.com/security/cve/CVE-2018-5380 · Note
• https://suse.com/security/cve/CVE-2018-5280 · Note
• http://securityfocus.com/bid/102438 · Note
• https://suse.com/security/cve/CVE-2017-16227 · Note
• https://suse.com/security/cve/CVE-2018-5379 · Note
• https://suse.com/security/cve/CVE-2006-2223 · Note
• https://suse.com/security/cve/CVE-2018-5381 · Note
• https://suse.com/security/cve/CVE-2018-5278 · Note
• https://suse.com/security/cve/CVE-2018-5281 · Note