Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-1188 — Cross-site Scripting in Dell EMC Isilon

CWE-79 — Cross-site ScriptingCWE-1188 — Initialization of a Resource with an Insecure Default14 documents6 sources
Severity
4.8MEDIUMNVD
EPSS
2.2%
top 15.71%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
ElectronDell EMC IsilonDell EMC Isilon Onefs
Timeline
PublishedMar 26
Latest updateMay 14

Description

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5dell_emc/isilon_onefsversions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, 8.0.0.0 - 8.0.0.6, versions 7.2.1.x
▶NVDdell/emc_isilon7.2.1.0 — 7.2.1.6+3
▶npmelectron/electron1.7.0 — 1.7.16+3

🔴Vulnerability Details

4
GHSA
GHSA-x8vm-x4jp-2234: Dell EMC Isilon versions between 8↗2022-05-14
▶
GHSA
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins↗2018-10-17
▶
GHSA
Electron webPreferences vulnerability can be used to perform remote code execution↗2018-08-23
▶
CVEList
CVE-2018-1188: Dell EMC Isilon versions between 8↗2018-03-26
▶

💥Exploits & PoCs

1
Exploit-DB
Dell EMC Isilon OneFS - Multiple Vulnerabilities↗2018-02-14
▶

💬Community

3
Bugzilla
CVE-2018-2790 OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969)↗2018-04-17
▶
Bugzilla
CVE-2018-2815 OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757)↗2018-04-14
▶
Bugzilla
CVE-2018-2798 OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)↗2018-04-14
▶
CVE-2018-1188 — Cross-site Scripting in Dell EMC Isilon | cvebase