CVE-2019-9508: Vertiv Avocent UMG-4000 version 4.2.1.19 web interface is vulnerable to stored cross site scripting
Vulnerability summary
CVE-2019-9508 is a medium (CVSS 6.3) Cross-site Scripting vulnerability in vertiv avocent_umg-4000_firmware. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities.
Timeline
- 30-03-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to stored XSS. A remote attacker authenticated with an administrator account could store a maliciously named file within the web application that would execute each time a user browsed to the page.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST3.5LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.63% on 26-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Vertiv1 product
- avocent_umg-4000_firmware4.2.1.19
1 vendor · 1 product