CVE-2018-18660

moderate-risk
Published 2018-10-26

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue.

Do I need to act?

-
0.31% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (6)

Udp
Udp
Udp
Udp
Udp
Udp

Affected Vendors

Arcserve

References (6)

Patch https://support.arcserve.com/s/article/360001392563?language=en_US
Patch https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UD...
Third Party Advisory https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
Patch https://support.arcserve.com/s/article/360001392563?language=en_US
Patch https://support.arcserve.com/s/article/Security-vulnerabilities-with-Arcserve-UD...
Third Party Advisory https://www.digitaldefense.com/blog/zero-day-alerts/arcserve-disclosure/
37
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 1/34 · Minimal
Exposure 13/34 · Low