CVE-2018-9078 - CVE House
Back to Database
Status published High CVE-2018-9078

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Vulnerability Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9078

Credits & Attribution

No credits recorded in the NVD database.

References

More from Lenovo Group LTD

View All →
CVE-2018-9082
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.8
CVE-2018-9081
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Medium 4.7
CVE-2018-9080
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Medium 5.9
CVE-2018-9079
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Critical 9.8
CVE-2018-9077
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.1

Affected Vendor

Lenovo Group LTD

View all reports →

Affected Software

Iomega StorCenter, LenovoEMC, EZ Media and Backup Center
Vulnerable Versions:
4.1.402.34662

Timeline

Official Publish: September 28th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.