CVE-2018-14697 Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter.
MediumCVSS 6.1
EPSS 0.71%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drobo 5n2 firmware | = 4.0.5-13.28.96115 | No fix listed |
References
- blog.securityevaluators.com exploit third-party-advisory