CVE-2018-3699 Cross-site scripting in Intel RAID Web Console v3
An unauthenticated attacker can exploit cross-site scripting in Intel RAID Web Console to elevate privileges via remote access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-3699?
CVE-2018-3699 is a medium-severity cross-site scripting vulnerability in Intel RAID Web Console v3, published on 14 Nov 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access.
Weakness: CWE-79
Which versions are affected by CVE-2018-3699?
It affects 1 product.
Products include Intel Raid Web Console 3.
How do I fix CVE-2018-3699?
No fix has been published for CVE-2018-3699 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-3699 being exploited?
There is no known exploitation of CVE-2018-3699 in the wild and no public exploit code.
Other vulnerabilities in Intel RAID Web Console v3
- CVE-2019-11119 Auth bypass in Intel(R) RAID Web Console 3 for Windows*
- CVE-2020-0564 Privilege escalation in Intel® RAID Web Console 3 (RWC3) for Windows
- CVE-2019-14601 Privilege escalation in Intel(R) RWC 3 for Windows
- CVE-2020-8688 Denial of service in Intel(R) RAID Web Console 3 for Windows* Advisory
- CVE-2018-3696 Auth bypass in Intel RAID Web Console v3 for Windows
Sources
Also known as GHSA-rcpg-q2hw-4546.