CVE-2018-1155 - In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area

Back Back to CVE browser

MEDIUM

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area

Published Aug 2, 2018

5.4

MEDIUM

CVSS 3.0

EPSS 0.57%

Description

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.

Affected products

Vendor Tenable Product SecurityCenter Default
unknown
Affected
- All versions prior to 5.7.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Tenable	SecurityCenter	unknown	Affected All versions prior to 5.7.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://www.securitytracker.com/id/1041431
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11793
Advisory
https://www.tenable.com/security/tns-2018-11
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securitytracker.com/id/1041431		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11793		Advisory
https://www.tenable.com/security/tns-2018-11		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner tenable

Published Aug 2, 2018

Updated Sep 17, 2024

Reserved Dec 5, 2017

Link CVE-2018-1155

CISA Vulnrichment

No data

NVD

Status Modified

Modified Aug 17, 2026

Link CVE-2018-1155

Red Hat

No data

ENISA EUVD

Assigner tenable

Published Aug 2, 2018

Updated Sep 17, 2024

Link EUVD-2018-11793

GitHub

No data