DOM-based XSS Vulnerability in Lenovo Enterprise Network Disk
CVE-2020-8348

6.1MEDIUM

Key Information:

Vendor

Lenovo
Status
Enterprise Network Disk
Vendor
CVE Published:
24 September 2020

What is CVE-2020-8348?

A security vulnerability exists within Lenovo's Enterprise Network Disk that permits a DOM-based cross-site scripting (XSS) attack. This flaw, found in versions prior to 6.1 patch 6 hotfix 4, could allow an attacker to execute arbitrary code within the browser session of an authenticated user if they are tricked into visiting a specially crafted URL. Users are advised to exercise caution against potential phishing attempts that exploit this vulnerability.

Affected Version(s)

Enterprise Network Disk < 6.1 patch 6 hotfix 4

References

https://iknow.lenovo.com.cn/detail/dc_191492.html
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks jingzhe for reporting this issue.
.