XSS in Tridium Niagara
CVE-2018-18985
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-sit…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.010 (57.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Tridium Niagara — versions 4.4u2
- Tridium Niagara_ax_framework — versions 3.8u4
- Tridium Niagara_enterprise_security — versions 2.3u1
- Tridium Niagara Enterprise Security 2.3u1, All Versions Prior To 2.3.118.6, Ax 3.8u4, 3.8.401.1, 4.4u2, 4.4.93.40.2, And 4.6, 4.6.96.28.4 — versions Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-18985?
- CVE-2018-18985 is a medium-severity vulnerability in Tridium Niagara, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-01-29.
- How severe is CVE-2018-18985?
- Medium severity. CVSS v3 base score is 5.4 out of 10.