Back to Database
Status published
Medium
CVE-2018-18985
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6,...
Vulnerability Description
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18985
Credits & Attribution
No credits recorded in the NVD database.
References
More from Tridium
View All →CVE-2025-3945
Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)
High
7.2
CVE-2025-3944
Incorrect Permission Assignment for Critical Resource
High
7.2
CVE-2025-3943
Use of GET Request Method With sensitive Query Strings
Medium
4.1
CVE-2025-3942
Improper Output Neutralization for Logs
Medium
4.3
CVE-2025-3941
Improper Handling of Windows: DATA Alternate Data Stream
Medium
5.4
Affected Vendor
Tridium
View all reports →Affected Software
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4
Vulnerable Versions:
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4
Timeline
Official Publish:
January 29th, 2019
Last Modified:
September 16th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N