« Volver al listado

CVE-2026-8474

Estado: AplazadaMedia (5.3)—

A vulnerability was discovered on Stormshield Network Security

It is possible to execute a reflected XSS attack on the login API available on Stormshield SNS appliance by executing a script on the victim's machine. The risks include the theft of cookies or other sensitive data, as well as the modification of page behavior, for example, by redirecting the victim to malicious websites.

Detalles técnicos trazas, registros y código del informe original
  *  4.3.0 to 4.3.41, 
  *  4.8.0 to 4.8.15, 
  *  5.0.0 to 5.0.5

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Stormshield — Stormshield Network SecurityAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-8474",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8474",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-01T13:05:31.957702Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cert@airbus.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cert@airbus.com",
      "affectedData": [
        {
          "vendor": "StormShield",
          "product": "StormShield Network Security",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver",
              "lessThanOrEqual": "4.3.41"
            },
            {
              "status": "affected",
              "version": "4.8.0",
              "versionType": "semver",
              "lessThanOrEqual": "4.8.15"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.0.5"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-01T09:16:21.163",
  "references": [
    {
      "url": "https://advisories.stormshield.eu/2026-003/",
      "source": "cert@airbus.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cert@airbus.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was discovered on Stormshield Network Security \n\n\n\n\n\n  *  4.3.0 to 4.3.41, \n  *  4.8.0 to 4.8.15, \n  *  5.0.0 to 5.0.5\n\n\n\n\n\n\n\n\nIt is possible to execute a reflected XSS attack on the login API available on Stormshield SNS appliance by executing a script on the victim's machine. The risks include the theft of cookies or other sensitive data, as well as the modification of page behavior, for example, by redirecting the victim to malicious websites."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue descubierta en Stormshield Network Security\n\n  *  4.3.0 a 4.3.41,\n  *  4.8.0 a 4.8.15,\n  *  5.0.0 a 5.0.5\n\nEs posible ejecutar un ataque XSS reflejado en la API de inicio de sesión disponible en el dispositivo Stormshield SNS mediante la ejecución de un script en la máquina de la víctima. Los riesgos incluyen el robo de cookies u otros datos sensibles, así como la modificación del comportamiento de la página, por ejemplo, al redirigir a la víctima a sitios web maliciosos."
    }
  ],
  "lastModified": "2026-07-22T07:10:00.107",
  "sourceIdentifier": "cert@airbus.com"
}