Cross-Site Scripting Vulnerability in Flexense DiskBoss Enterprise
CVE-2018-10294

6.1MEDIUM

Key Information:

Vendor

Flexense

Status
Diskboss
Vendor
CVE Published:
2 May 2018

What is CVE-2018-10294?

Flexense DiskBoss Enterprise versions 7.4.28 through 9.1.16 are vulnerable to a Cross-Site Scripting (XSS) attack. This vulnerability allows malicious users to inject arbitrary web scripts into the affected application. When a user accesses a compromised page, their browser could execute those scripts with the same permissions as the user, potentially compromising sensitive information and site functionality. Administrators of DiskBoss Enterprise should prioritize updating to the latest version to mitigate this risk.

References

http://seclists.org/fulldisclosure/2018/May/3
mailing-listx_refsource_FULLDISC
http://blog.n0ipr0cs.io/post/2018/04/29/XSS-Flexense-Disk...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.