PT-2019-8891 · Seagate · Seagate Nas Os

Published 2019-05-13 · Updated 2019-05-13 · CVE-2018-12304

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue concerns cross-site scripting in the Application Manager. Attackers can execute JavaScript via multiple application metadata fields, including Short Description, Publisher Name, Publisher Contact, or Website URL.

Recommendations For Seagate NAS OS version 4.3.15.1, avoid using the vulnerable metadata fields until a patch is available. As a temporary workaround, consider restricting access to the Application Manager to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-12304

Affected Products

Seagate Nas Os

References · 3

• 🔥 https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-12304 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12304 · Vendor Advisory