CVE-2018-9078
Estado: ModificadaAlta (8.8)—
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.04%
- Percentil entre todas las CVEs puntuadas: 63
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (20)
Lenovo — EZ Media & Backup Center FirmwareLenovo — IX2 FirmwareLenovo — Ix4-300d FirmwareLenovo — Px12-400r FirmwareLenovo — Px12-450r FirmwareLenovo — Px2-300d FirmwareLenovo — Px4-300d FirmwareLenovo — Px4-300r FirmwareLenovo — Px4-400d FirmwareLenovo — Px4-400r FirmwareLenovo — Px6-300d FirmwareLenovo — Storcenter Ix2-dl FirmwareLenovo — Storcenter IX2 FirmwareLenovo — Storcenter Ix4-300d FirmwareLenovo — Storcenter Px12-400r FirmwareLenovo — Storcenter Px12-450r FirmwareLenovo — Storcenter Px2-300d FirmwareLenovo — Storcenter Px4-300d FirmwareLenovo — Storcenter Px4-300r FirmwareLenovo — Storcenter Px6-300d Firmware
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-9078",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@lenovo.com",
"affectedData": [
{
"vendor": "Lenovo Group LTD",
"product": "Iomega StorCenter",
"versions": [
{
"status": "affected",
"version": "4.1.402.34662",
"versionType": "custom",
"lessThanOrEqual": "4.1.402.34662"
}
]
},
{
"vendor": "Lenovo Group LTD",
"product": "LenovoEMC",
"versions": [
{
"status": "affected",
"version": "4.1.402.34662",
"versionType": "custom",
"lessThanOrEqual": "4.1.402.34662"
}
]
},
{
"vendor": "Lenovo Group LTD",
"product": "EZ Media and Backup Center",
"versions": [
{
"status": "affected",
"version": "4.1.402.34662",
"versionType": "custom",
"lessThanOrEqual": "4.1.402.34662"
}
]
}
]
}
],
"published": "2018-09-28T20:29:01.097",
"references": [
{
"url": "https://support.lenovo.com/us/en/solutions/LEN-24224",
"tags": [
"Vendor Advisory"
],
"source": "psirt@lenovo.com"
},
{
"url": "https://support.lenovo.com/us/en/solutions/LEN-24224",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file."
},
{
"lang": "es",
"value": "Para algunos dispositivos NAS Iomega, Lenovo y LenovoEMC en versiones 4.1.402.34662 y anteriores, la aplicación Content Explorer otorga a los usuarios la capacidad de subir archivos a almacenes y esta imagen fue renderizada en el navegador en el origen del dispositivo en lugar de solicitar descargar el activo. La aplicación no evita que el usuario suba imágenes SVG y las devuelve a su origen. Como resultado, los usuarios maliciosos pueden subir imágenes SVG que contienen JavaScript arbitrario que se evalúa cuando la víctima lanza una petición para descargar el archivo."
}
],
"lastModified": "2026-06-17T02:06:02.530",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C681D87-390C-4515-876B-56F301C6C2E8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CDDD583F-99C1-474D-9D33-CB3FFBF87710"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1552A6C4-D72C-4F4A-959A-A74FB2F9331F"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AC5322D3-C5F9-4E1B-9E92-E4199D4D4E38"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6DC36B80-3542-46E8-ABB0-988BF8405336"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "74CF0CA3-C011-479E-90DB-1C4D9136778C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C7F667B-CF55-458E-A0DF-2D0BA47FF34E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8750825E-AD9D-43FF-BA19-C1DC360E4050"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "57CA96CA-47B7-4C36-B160-49AEAFEC7AE9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "30DAD273-0243-4C4B-BA48-98843262D454"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9442509-43F9-43AE-ABB8-A109029CBCB8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "67148992-00E9-4F99-8027-6AA0C56D64C3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0538AFC3-AF46-4A3D-BDA2-3D2B287C5083"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70A8A885-87E4-47B6-964C-BD6B2CC253C3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D076F4B4-CC3B-4FC4-8E65-D2B656FB8F3E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3CF64BC7-7AE0-4822-9F95-325EF6B914CB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73152B06-114D-41CA-B4A4-F430F7A1D818"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7E46920A-82FF-4E15-AB22-DFDB6D532DB2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ez_media_\\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815AF29A-A455-4452-BEDC-469072A078CF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ez_media_\\&_backup_center:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70B23F2C-23A4-44E1-AD8B-89F3A9E32013"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24151BE4-3D25-4ED6-BD93-117C9AEDEC80"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BDEDB98C-CB83-467A-B866-1E26146977BA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5FB2FAB-E9C6-48F9-B4B0-5FAF908E9FEF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "068F1733-22CD-4265-8519-54968CBCDA51"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BAE671E-04BF-4BAE-847A-8236FB9EB927"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3D8C2AAD-0356-4C4C-B1F2-50736844A809"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7298F84-E758-4AB3-9F0C-6F6B11997E69"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "93AECD5C-256C-4F24-8162-14E569CDCED6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83A7AFAE-89F3-4E69-83C4-77361D5DBD2B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E32EDB44-96C0-425C-B192-0AE8C5BC265A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F95A331F-E040-4025-AD3F-C6118204091D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2441B8E2-C356-49C1-BD7B-028C4A83616C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80271F4B-3195-4A9A-A5B7-9CED966AC29C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EF9B4663-D9EB-4207-B393-CDF45F020A86"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96FCF0FF-5EF8-4E9E-B22B-ABE34134BF53"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C110122A-D64C-417F-BC56-0F0B34509062"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5B15B3E-FE90-43C1-9724-1FA19D4F0759"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D5C1AB5D-19B0-43F0-9656-3D78ED8047F6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5471D381-CEEB-4351-B78A-41ECA2656A37"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9C0F4B2B-B3E1-4456-B57A-7E96BAFC6507"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:lenovo:ez_media_\\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815AF29A-A455-4452-BEDC-469072A078CF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:lenovo:ez_media_\\&_backup_center:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70B23F2C-23A4-44E1-AD8B-89F3A9E32013"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "psirt@lenovo.com"
}