CVE-2018-10383
published 2019-05-02CVE-2018-10383: Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
PriorityP336medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.91%
77.2th percentile
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lantronix | securelinx_spider_firmware | < 2.2 | 2.2 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2018-10383 [MEDIUM] Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
Template:
id: CVE-2018-10383
info:
name: Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting
author: ritikchaddha
severity: medium
description: |
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
impact: |
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, credentials, or performing actions on behalf of users.
remediation: |
Apply the latest security patches from Lantronix or upgrade to a patched firmware version.
reference:
- https://github.com/grymer/CVE/blob/master/CVE-2018-10383.md
- https://nvd.nist.gov/vuln/detail/CVE-2018-10383
classificatio
No writeups or analysis indexed.
2019-05-02
Published