CVE-2018-10692: XSS

Published Jun 7, 2019

Updated

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.

Affected Software

2 affected components

MOXA Awk-3121 Firmware=1.14

MOXA AWK-3121

Event History

Jun 7, 2019

CVE Published

via MITRE·07:21 PM

Data Sourced

via MITRE·07:21 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10692?

CVE-2018-10692 is considered a high severity issue due to the risk of session hijacking through cross-site scripting.

How do I fix CVE-2018-10692?

To fix CVE-2018-10692, you should ensure that the session cookie is set with the HttpOnly flag to prevent access by JavaScript.

What are the affected devices for CVE-2018-10692?

CVE-2018-10692 specifically affects Moxa AWK-3121 devices running firmware version 1.14.

What type of attack can exploit CVE-2018-10692?

CVE-2018-10692 can be exploited through cross-site scripting (XSS) attacks.

What is the risk associated with CVE-2018-10692?

The risk associated with CVE-2018-10692 includes the potential for an attacker to steal session cookies and impersonate users.