Medium severity · published May 23, 2018
CVE-2018-6495
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and…
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cms Server · Microfocus
4.10; 4.11; 4.12; 4.13; 4.14; 4.15.1 · source: NVD
UC
Universal Cmdb · Microfocus
0.20; 10.21; 10.22; 10.30; 10.31; 10.32; +2 more · source: NVD
UC
Universal Cmdb Browser · Microfocus
4.10; 4.11; 4.12; 4.13; 4.14; 4.15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6495
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6495
www.securitytracker.com
http://www.securitytracker.com/id/1040970
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03164778
More from Cms Server
8.8
CVE-2018-6497
Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33,…