CVE-2018-7064 Cross-site scripting in Aruba Instant (IAP)
Reflected XSS in Aruba Instant web interface allows attackers to hijack admin sessions or perform unauthorized actions via malicious links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-7064?
CVE-2018-7064 is a medium-severity cross-site scripting vulnerability in Siemens Scalance W1750d Firmware, published on 10 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
Weakness: CWE-79
Which versions are affected by CVE-2018-7064?
It affects 2 products.
Products include Arubanetworks Aruba Instant, Siemens Scalance W1750d Firmware.
How do I fix CVE-2018-7064?
No fix has been published for CVE-2018-7064 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-7064 being exploited?
There is no known exploitation of CVE-2018-7064 in the wild and no public exploit code.
Other vulnerabilities in Siemens Scalance W1750d Firmware
Sources
Also known as GHSA-h438-gvrc-w5f9.