CVE-2018-10700
Severity Score
6.1
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection.
Se encontró un problema en los dispositivos Moxa AWK-3121 versión 1.19. Proporciona funcionalidad para que un administrador pueda cambiar el nombre del dispositivo. Sin embargo, la misma funcionalidad permite que un atacante ejecute XSS inyectando una carga XSS. El parámetro POST "iw_board_deviceName" es susceptible a esta inyección.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-05-03 CVE Reserved
- 2019-06-07 CVE Published
- 2024-05-31 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html | X_refsource_misc |
|
| https://seclists.org/bugtraq/2019/Jun/8 | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Moxa Search vendor "Moxa" | Awk-3121 Firmware Search vendor "Moxa" for product "Awk-3121 Firmware" | 1.19 Search vendor "Moxa" for product "Awk-3121 Firmware" and version "1.19" | - |
Affected
| in | Moxa Search vendor "Moxa" | Awk-3121 Search vendor "Moxa" for product "Awk-3121" | - | - |
Safe
|