CVE-2018-1155

{"containers": {"cna": {"affected": [{"product": "SecurityCenter", "vendor": "Tenable", "versions": [{"status": "affected", "version": "All versions prior to 5.7.0"}]}], "datePublic": "2018-07-31T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue."}], "problemTypes": [{"descriptions": [{"description": "Cross-Site Scripting (XSS)", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-12T09:57:01.000Z", "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "shortName": "tenable"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.tenable.com/security/tns-2018-11"}, {"name": "1041431", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041431"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vulnreport@tenable.com", "DATE_PUBLIC": "2018-07-31T00:00:00", "ID": "CVE-2018-1155", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SecurityCenter", "version": {"version_data": [{"version_value": "All versions prior to 5.7.0"}]}}]}, "vendor_name": "Tenable"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-Site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://www.tenable.com/security/tns-2018-11", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2018-11"}, {"name": "1041431", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041431"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:51:48.853Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tenable.com/security/tns-2018-11"}, {"name": "1041431", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1041431"}]}]}, "cveMetadata": {"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be", "assignerShortName": "tenable", "cveId": "CVE-2018-1155", "datePublished": "2018-08-02T19:00:00.000Z", "dateReserved": "2017-12-05T00:00:00.000Z", "dateUpdated": "2024-09-17T01:32:05.620Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "SecurityCenter", "vendor": "Tenable", "versions": [{"status": "affected", "version": "All versions prior to 5.7.0"}]}], "source": "vulnreport@tenable.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tenable:security_center:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2E5831B-E78C-4CA4-A53E-789D40F8C91D", "versionEndExcluding": "5.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue."}, {"lang": "es", "value": "En SecurityCenter, en versiones anteriores a la 5.7.0, un problema de Cross-Site Scripting (XSS) podr\u00eda permitir que un atacante autenticado inyecte c\u00f3digo JavaScript en un par\u00e1metro image filename en el \u00e1rea de la funcionalidad Reports. Se han implementado t\u00e9cnicas de validaci\u00f3n de entradas correctamente actualizadas para corregir este problema."}], "id": "CVE-2018-1155", "lastModified": "2026-08-17T14:50:49.470", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-08-02T19:29:00.873", "references": [{"source": "vulnreport@tenable.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041431"}, {"source": "vulnreport@tenable.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2018-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041431"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.tenable.com/security/tns-2018-11"}], "sourceIdentifier": "vulnreport@tenable.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}