PT-2019-8887 · Seagate · Seagate Nas Os

Published 2019-05-13 · Updated 2019-05-13 · CVE-2018-12300

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue allows attackers to disclose information in the Referer header via the 'state' URL parameter in echo-server.html. This is due to an arbitrary redirect in the affected software.

Recommendations For Seagate NAS OS version 4.3.15.1, avoid using the state URL parameter in the affected echo-server.html until the issue is resolved. As a temporary workaround, consider restricting access to the echo-server.html page to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2018-12300

Affected Products

Seagate Nas Os

References · 3

• 🔥 https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12300 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12300 · Vendor Advisory