CVE-2018-15699

ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by inserting Javascript into the configuration files Version field.

Score

CVSS 3.0 6.1 Medium

Status

Modified - vulnreport@tenable.com

Published

2018-08-27

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Data Master (Asustor)
• Asustor Data Master (Tenable)

References

• https://www.tenable.com/security/research/tra-2018-22