CVE-2018-7355

All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483	Vendor Advisory
https://www.exploit-db.com/exploits/46102/
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483	Vendor Advisory
https://www.exploit-db.com/exploits/46102/

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zte:mf65_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf65:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:zte:mf65m1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf65m1:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-09-26 16:29

Updated : 2024-11-21 04:12

NVD link : CVE-2018-7355

Mitre link : CVE-2018-7355

CVE.ORG link : CVE-2018-7355

JSON object : View

Products Affected

zte

mf65
mf65_firmware
mf65m1
mf65m1_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-7355", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-09-26T16:29:01.673", "references": [{"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483", "tags": ["Vendor Advisory"], "source": "psirt@zte.com.cn"}, {"url": "https://www.exploit-db.com/exploits/46102/", "source": "psirt@zte.com.cn"}, {"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/46102/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neutralization of input during web page generation, an attacker could exploit this vulnerability to conduct reflected XSS or HTML injection attacks on the devices."}, {"lang": "es", "value": "Las versiones hasta la V1.0.0B05 de ZTE MF65 y todas las versiones hasta la V1.0.0B02 de ZTE MF65M1 se han visto impactadas por una vulnerabilidad de Cross-Site Scripting (XSS). Debido a la neutralizaci\u00f3n incorrecta de las entradas durante la generaci\u00f3n de p\u00e1ginas web, un atacante podr\u00eda explotar esta vulnerabilidad para realizar ataques de Cross-Site Scripting (XSS) reflejado o inyecci\u00f3n HTML en los dispositivos."}], "lastModified": "2024-11-21T04:12:03.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf65_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00C00C3B-6A05-460B-9836-A079862810CE", "versionEndIncluding": "1.0.0b05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf65:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1F285860-8300-418C-BD17-73B91B89524C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf65m1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD080FF6-1A76-43DC-A774-7A4C367CA65C", "versionEndIncluding": "1.0.0b02"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf65m1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0AB38DD0-13D5-4064-BE5C-2A7DCAF2FDF4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@zte.com.cn"}