CVE-2018-21033 Cross-site scripting in n/a
Authenticated attackers can inject arbitrary CSS tokens in Hitachi storage management tools, potentially leading to script execution or session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-21033?
CVE-2018-21033 is a medium-severity cross-site scripting vulnerability in n/a, published on 14 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager.
Weakness: CWE-20
Which versions are affected by CVE-2018-21033?
It affects 8 products.
Products include Hitachi Automation Director, Hitachi Compute Systems Manager, Hitachi Device Manager, Hitachi Global Link Manager, Hitachi Infrastructure Analytics Advisor, Hitachi Replication Manager and 2 more.
How do I fix CVE-2018-21033?
No fix has been published for CVE-2018-21033 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-21033 being exploited?
There is no known exploitation of CVE-2018-21033 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x4xv-pfvp-jg8m.