CVE-2018-8900 Cross-site scripting in n/a

What is CVE-2018-8900?

CVE-2018-8900 is a medium-severity cross-site scripting vulnerability in n/a, published on 2 May 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The License Manager service of HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE 7.80 allows remote attackers to inject malicious web script in the logs page of Admin Control Center (ACC) for cross-site scripting (XSS) vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2018-8900?

It affects 1 product.

Products include Gemalto Sentinel Ldk Rte.

How do I fix CVE-2018-8900?

No fix has been published for CVE-2018-8900 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-8900 being exploited?

There is no known exploitation of CVE-2018-8900 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-11496 Memory corruption in n/a Critical 9.8
• CVE-2017-11497 Memory corruption in n/a Critical 9.8
• CVE-2018-6304 Denial of service in Gemalto's Sentinel LDK RTE High 7.5
• CVE-2018-6305 Denial of service in Gemalto's Sentinel LDK RTE High 7.5
• CVE-2017-11498 Denial of service in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fhpx-8xmm-758p.