XSS in Tridium Niagara
CVE-2018-18985
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.010 (60.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 60.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Tridium Niagara — versions 4.4u2
- Tridium Niagara Ax Framework — versions 3.8u4
- Tridium Niagara Enterprise Security — versions 2.3u1
- Tridium Niagara Enterprise Security 2.3u1, All Versions Prior To 2.3.118.6, Ax 3.8u4, 3.8.401.1, 4.4u2, 4.4.93.40.2, And 4.6, 4.6.96.28.4 — versions Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4
Weakness classification (CWE)
References
- www.securityfocus.com/bid/106530 (VDB Entry, Third Party Advisory, vdb-entry)
- ics-cert.us-cert.gov/advisories/ICSA-18-333-02 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-18985?
- CVE-2018-18985 is a medium-severity vulnerability in Tridium Niagara, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-01-29.
- How severe is CVE-2018-18985?
- Medium severity. CVSS v3 base score is 5.4 out of 10.