CVE-2019-3708
Cross-Site Scripting Vulnerability in OVA file upload feature
Severity Score
9.6
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.
IsilonSD Management Server versión 1.1.0, contiene una vulnerabilidad de tipo cross-site scripting durante la carga de un archivo OVA. Un atacante remoto puede engañar a un usuario administrador para operar potencialmente esta vulnerabilidad y ejecutar código HTML o JavaScript malicioso en el contexto del usuario administrador.
*Credits:
Dell EMC would like to thank Jarrod Farncomb for reporting this vulnerability.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-01-03 CVE Reserved
- 2019-04-05 CVE Published
- 2023-05-27 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL | Tag | Source |
---|---|---|
https://seclists.org/fulldisclosure/2019/Apr/16 | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Dell Search vendor "Dell" | Emc Isilonsd Management Server Search vendor "Dell" for product "Emc Isilonsd Management Server" | 1.1.0 Search vendor "Dell" for product "Emc Isilonsd Management Server" and version "1.1.0" | - |
Affected
|