CVE-2018-1188

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.

CVSS v3.0

4.8 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.86% chance of exploitation in the next 30 days, 78th percentile

Published

2018-03-26

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44039

References

• CVE Record
• NVD entry

Related

• CVE-2018-1187
• CVE-2018-1189
• CVE-2018-1186
• CVE-2018-1201
• CVE-2018-1185
• CVE-2018-12015