CVE-2018-19525: XSS

Published Mar 17, 2019

Updated

An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1TRUNK-20180914.bin devices. There is CSRF via /ui/?g=objkeywordsadd and /ui/?g=objkeywordsaddsave with resultant XSS because of a lack of csrf token validation.

Affected Software

6 affected components

Systrome Cumilon Isg-600c Firmware=1.1-r2.1

Systrome Cumilon ISG-600C

Systrome Cumilon Isg-600h Firmware=1.1-r2.1

Systrome Cumilon Isg-600h

Systrome Cumilon Isg-800w Firmware=1.1-r2.1

Systrome Cumilon Isg-800w

Event History

Mar 17, 2019

CVE Published

via MITRE·06:43 PM

Data Sourced

via MITRE·06:43 PM

Description

Frequently Asked Questions

Which deployments are known to be affected?

The issue was identified on Systrome ISG-600C, ISG-600H, and ISG-800W devices running 1.1-R2.1_TRUNK-20180914.bin firmware.

What does an attacker need to exploit this issue?

The CVSS vector indicates network access, no privileges, low attack complexity, and user interaction. Exploitation involves CSRF against the specified keyword-management endpoints, with resulting cross-site scripting.

Which endpoints are involved?

The affected endpoints are /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave. The issue is attributed to missing CSRF token validation on these requests.

CVE-2018-19525: XSS

Affected Software

Event History

Frequently Asked Questions

Which deployments are known to be affected?

What does an attacker need to exploit this issue?

Which endpoints are involved?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are known to be affected?

What does an attacker need to exploit this issue?

Which endpoints are involved?