VULNERABILITY INTELLIGENCE

CVE-2018-1155

CVSS score5.4 MEDIUM

EPSS probability0.57%

CISA KEVNot currently listed

Published2018-08-02

Last modified2026-08-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

vulnreport@tenable.com — Third Party Advisory, VDB Entry
vulnreport@tenable.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory