CVE-2018-19391

Опубликовано: 15 мар. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.

Ссылки

https://cyberskr.com/blog/cobham-satcom-250-500.html
Exploit
Third Party Advisory
https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0
Third Party Advisory
https://cyberskr.com/blog/cobham-satcom-250-500.html
Exploit
Third Party Advisory
https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:cobham:satcom_sailor_250_firmware:*:*:*:*:*:*:*:*

Версия до 1.25 (исключая)

cpe:2.3:h:cobham:satcom_sailor_250:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:cobham:satcom_sailor_500_firmware:*:*:*:*:*:*:*:*

Версия до 1.25 (исключая)

cpe:2.3:h:cobham:satcom_sailor_500:-:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00489

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-hxcv-xwcm-5m8c