CVE-2018-9081 - CVE House
Back to Database
Status published Medium CVE-2018-9081

Iomega and LenovoEMC NAS Web UI Vulnerabilities

Vulnerability Description

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-9081

Credits & Attribution

No credits recorded in the NVD database.

References

More from Lenovo Group LTD

View All →
CVE-2018-9082
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.8
CVE-2018-9080
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Medium 5.9
CVE-2018-9079
Iomega and LenovoEMC NAS Web UI Vulnerabilities
Critical 9.8
CVE-2018-9078
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.8
CVE-2018-9077
Iomega and LenovoEMC NAS Web UI Vulnerabilities
High 8.1

Affected Vendor

Lenovo Group LTD

View all reports →

Affected Software

Iomega StorCenter, LenovoEMC, EZ Media and Backup Center
Vulnerable Versions:
4.1.402.34662

Timeline

Official Publish: September 28th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.