CVE-2018-1155
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue allows an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area.
Risk Assessment
An authenticated attacker can exploit XSS to execute scripts in other users' browsers, potentially leading to data theft or session hijacking.
Recommendation
Upgrade SecurityCenter to version 5.7.0 or later, which includes input validation fixes.
Other vulnerabilities in Tenable SecurityCenter
See all- CVE-2018-1154High
In SecurityCenter versions prior to 5.7.0, a username enumeration issue allows an unauthenticated attacker to automate discovery of username aliases via brute force, potentially facilitating unauthorized access.
- CVE-2013-5911Medium
A cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Original NVD description (English source)
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.