« Volver al listado

CVE-2018-1186

Estado: ModificadaMedia (4.8)—

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — EMC Isilon

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1186",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell EMC",
          "product": "Isilon OneFS",
          "versions": [
            {
              "status": "affected",
              "version": "versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, 8.0.0.0 - 8.0.0.6, versions 7.2.1.x and version 7.1.1.11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-03-26T18:29:00.910",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2018/Mar/50",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/103033",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44039/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2018/Mar/50",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/103033",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/44039/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website."
    },
    {
      "lang": "es",
      "value": "Dell EMC Isilon en versiones entre la 8.1.0.0 y la 8.1.0.1, la 8.0.1.0 y la 8.0.1.2 y entre la 8.0.0.0 y la 8.0.0.6; versiones 7.2.1.x y versión 7.1.1.11 contiene una vulnerabilidad de Cross-Site Scripting (XSS) en la descripción del clúster de la interfaz de administración web OneFS. Un administrador malicioso podría inyectar código HTML o JavaScript arbitrario en la sesión del navegador del usuario, en el contexto del sitio web OneFS."
    }
  ],
  "lastModified": "2026-06-17T01:50:39.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80A22476-2261-41FD-AD38-F684068C9B79",
              "versionEndIncluding": "7.2.1.6",
              "versionStartIncluding": "7.2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "091E9868-D392-4C38-90FA-54AC8D9E4319",
              "versionEndIncluding": "8.0.0.6",
              "versionStartIncluding": "8.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90EE5598-0C42-4292-8C8B-D00F81F9C46C",
              "versionEndIncluding": "8.0.1.2",
              "versionStartIncluding": "8.0.1.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "909C1B60-2129-467B-A1F0-5BC03DEEA896",
              "versionEndIncluding": "8.1.0.1",
              "versionStartIncluding": "8.1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon:7.1.1.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F91DCEDA-03B1-43C7-89B9-175650A70C68"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}