« Volver al listado

CVE-2018-6492

Estado: ModificadaMedia (6.1)—

Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow persistent cross-site scripting, and non-persistent HTML Injection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

HP — Network AutomationHP — Network Operations Management Ultimate

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-6492",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "Micro Focus",
          "product": "Network Operations Management Ultimate",
          "versions": [
            {
              "status": "affected",
              "version": "2017.07, 2017.11, 2018.02"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Network Automation",
          "versions": [
            {
              "status": "affected",
              "version": "10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-22T19:29:00.707",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104131",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1040900",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158014",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104131",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1040900",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158014",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow persistent cross-site scripting, and non-persistent HTML Injection."
    },
    {
      "lang": "es",
      "value": "Cross-Site Scripting (XSS) persistente e inyección HTML no persistente en HP Network Operations Management Ultimate, versiones 2017.07, 2017.11 y 2018.02 y en Network Automation, versiones 10.00, 10.10, 10.11, 10.20, 10.30, 10.40 y 10.50. La vulnerabilidad podría explotarse remotamente para permitir Cross-Site Scripting (XSS) persistente y una inyección HTML no persistente."
    }
  ],
  "lastModified": "2026-06-17T02:01:54.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:network_operations_management_ultimate:2017.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A3F9593-C1BC-4B48-B007-4877EF49B725"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_operations_management_ultimate:2017.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56A77056-BBF3-4F8B-BEE1-231A61C40156"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_operations_management_ultimate:2018.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46DD1E7E-CA4A-4672-AC09-AFC639AC9EB7"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C74FE8A-030D-4C47-AE1F-2DC84C2D55BF"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6CA263E-3137-4B14-81B1-CA3DF5AAD845"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27A3AA40-2F05-4802-95A2-CCB57D9B1B62"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34BFE988-538A-40A9-BF9B-D36FA446C994"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A669FE08-E770-45CC-93ED-AD3901D5E218"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CC9AE65-24AF-43DB-81F6-BDF67B63F6A1"
            },
            {
              "criteria": "cpe:2.3:a:hp:network_automation:10.50:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B792109-3D86-4D93-9691-262DCE0F2B23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}