CVE-2018-5281

SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/102443	Third Party Advisory VDB Entry
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0002	Vendor Advisory
https://www.vulnerability-lab.com/get_content.php?id=1729	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:sonicwall:nsa_250m:-:::::::*
	cpe:2.3:h:sonicwall:nsa_2600:-:::::::*
	cpe:2.3:h:sonicwall:nsa_2650:-:::::::*
	cpe:2.3:h:sonicwall:nsa_3600:-:::::::*
	cpe:2.3:h:sonicwall:nsa_4600:-:::::::*
	cpe:2.3:h:sonicwall:nsa_5600:-:::::::*
	cpe:2.3:h:sonicwall:nsa_6600:-:::::::*

History

No history.

Information

Published : 2018-01-08 09:29

Updated : 2022-06-16 16:18

NVD link : CVE-2018-5281

Mitre link : CVE-2018-5281

CVE.ORG link : CVE-2018-5281

JSON object : View

Products Affected

sonicwall

sonicos
nsa_5600
nsa_250m
nsa_2600
nsa_2650
nsa_3600
nsa_4600
nsa_6600

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-5281", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-01-08T09:29:00.277", "references": [{"url": "http://www.securityfocus.com/bid/102443", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0002", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=1729", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens."}, {"lang": "es", "value": "SonicWall SonicOS en dispositivos Network Security Appliance (NSA) 2017 Q4 tiene Cross-Site Scripting (XSS) a trav\u00e9s de las pantallas Cloud AV DB Exclusion Settings."}], "lastModified": "2022-06-16T16:18:39.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A29657F1-2177-431E-9726-0253979580A1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:sonicwall:nsa_250m:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2AB85AF3-DA8F-497D-AAB8-46D129A5A395"}, {"criteria": "cpe:2.3:h:sonicwall:nsa_2600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F86D13F9-D41E-4230-9116-A781FFAEF00D"}, {"criteria": "cpe:2.3:h:sonicwall:nsa_2650:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B7BCDFEE-DC5A-44B8-85DF-8BFC02B1A973"}, {"criteria": "cpe:2.3:h:sonicwall:nsa_3600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8A24BCC0-CE41-49AF-B03D-D4FCB422503B"}, {"criteria": "cpe:2.3:h:sonicwall:nsa_4600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8FD73880-DC60-467F-99B6-69807D58A840"}, {"criteria": "cpe:2.3:h:sonicwall:nsa_5600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B0CF683A-7E83-464B-8A0D-4CC641377FA6"}, {"criteria": "cpe:2.3:h:sonicwall:nsa_6600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CD9C3F77-2F1A-4C4F-A8F8-CDBFB7B87891"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}