CVE-2018-7976: huawei technologies co., ltd. espace desktop Cross-site Scripting

Vulnerability summary

CVE-2018-7976 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in huawei technologies co., ltd. espace desktop. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities.

Timeline

1. 01-06-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system and perform a XSS attack. A successful exploit could cause the eSpace Desktop to hang up, and the function will restore to normal after restarting the eSpace Desktop.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.