CVE-2018-10165

Опубликовано: 03 мая 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1_Windows.

Ссылки

http://www.securityfocus.com/bid/104094
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/104094
Third Party Advisory
VDB Entry
https://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tp-link:eap_controller:2.5.4:*:*:*:*:windows:*:*

cpe:2.3:a:tp-link:eap_controller:2.6.0:*:*:*:*:windows:*:*

EPSS

Процентиль: 49%

0.00257

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-3pm5-qmcr-c546