Medium severity · published May 22, 2018
CVE-2018-6492
Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation,…
6.1
CVSS
1.6%
EPSS
No
On KEV
Description
Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow persistent cross-site scripting, and non-persistent HTML Injection.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Network Automation · HP
10.00; 10.10; 10.11; 10.20; 10.30; 10.40; +1 more · source: NVD
NO
Network Operations Management Ultimate · HP
2017.07; 2017.11; 2018.02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6492
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6492
www.securityfocus.com
http://www.securityfocus.com/bid/104131
www.securitytracker.com
http://www.securitytracker.com/id/1040900
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158014
More from Network Automation
9.8
CVE-2017-5814
A remote sql injection authentication bypass in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found
9.8
CVE-2017-5810
A remote sql injection vulnerability in HPE Network Automation version 9.1x, 9.2x, 10.0x, 10.1x and 10.2x were found
9.8
CVE-2016-8511
A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.00.01, v10.00.02, v10.10, v10.11,…
9.8
CVE-2016-1989
HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a…
9.8
CVE-2016-1988
HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a…