CVE-2018-9078

high-risk

Published 2018-09-28

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.

Do I need to act?

0.47% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (20)

Storcenter Px12-450R Firmware

Storcenter Px12-400R Firmware

Storcenter Px4-300R Firmware

Storcenter Px6-300D Firmware

Storcenter Px4-300D Firmware

Storcenter Px2-300D Firmware

Storcenter Ix4-300D Firmware

Storcenter Ix2 Firmware

Storcenter Ix2-Dl Firmware

Ez Media \& Backup Center Firmware

Px12-450R Firmware

Px12-400R Firmware

Px4-400R Firmware

Px4-300R Firmware

Px6-300D Firmware

Px4-400D Firmware

Px4-300D Firmware

Px2-300D Firmware

Ix4-300D Firmware

Ix2 Firmware

Affected Vendors

Lenovo

References (2)

Vendor Advisory https://support.lenovo.com/us/en/solutions/LEN-24224

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 2/34 · Minimal

Exposure 20/34 · Moderate