« Volver al listado

CVE-2018-18985

Estado: ModificadaMedia (5.4)—

Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Tridium — NiagaraTridium — Niagara AX FrameworkTridium — Niagara Enterprise Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-18985",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Tridium",
          "product": "Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4",
          "versions": [
            {
              "status": "affected",
              "version": "Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-01-29T16:29:00.483",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/106530",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-333-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.securityfocus.com/bid/106530",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-333-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality."
    },
    {
      "lang": "es",
      "value": "Tridium Niagara Enterprise Security 2.3u1, en todas las versiones anteriores a la 2.3.118.6; Niagara AX 3.8u4, en todas las versiones anteriores a la 3.8.401.1; Niagara 4.4u2, en todas las versiones anteriores a la 4.4.93.40.2 y Niagara 4.6, en todas las versiones anteriores a la 4.6.96.28.4, contienen una vulnerabilidad Cross-Site Scripting (XSS) que podría permitir que un atacante remoto inyecte código en algunas páginas web, lo que afecta a la confidencialidad."
    }
  ],
  "lastModified": "2026-06-17T01:48:13.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F91AE04-D218-4A1A-AA9C-64BEC0351058",
              "versionEndExcluding": "4.4.93.40.2"
            },
            {
              "criteria": "cpe:2.3:a:tridium:niagara:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6265A9D-2E4C-46CD-BE33-ECB5A65678FE",
              "versionEndExcluding": "4.6.96.28.4",
              "versionStartIncluding": "4.6"
            },
            {
              "criteria": "cpe:2.3:a:tridium:niagara:4.4u2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A337C58-8D5B-4BA2-A916-8551F9B1B141"
            },
            {
              "criteria": "cpe:2.3:a:tridium:niagara_ax_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC3E8353-123A-45C3-B439-6A40B4A3AF1A",
              "versionEndExcluding": "3.8.401.1"
            },
            {
              "criteria": "cpe:2.3:a:tridium:niagara_ax_framework:3.8u4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B98B5F7F-75AF-46FE-9A76-66EF4D9A3A82"
            },
            {
              "criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE72BEA5-3F11-4CCC-BE8D-5CB887292D64",
              "versionEndExcluding": "2.3.118.6"
            },
            {
              "criteria": "cpe:2.3:a:tridium:niagara_enterprise_security:2.3u1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61618B9B-80C1-4B48-974C-4E9A7E692AFE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}