CVE-2018-21033 : A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation D

A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager.

Published 2020-02-14 16:15:10

Updated 2020-02-27 15:19:03

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2018-21033

Hitachi » Tuning Manager
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:tuning_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Hitachi » Device Manager
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:device_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
Hitachi » Tiered Storage Manager
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:tiered_storage_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Hitachi » Replication Manager
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:replication_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Hitachi » Global Link Manager
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:global_link_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Hitachi » Compute Systems Manager
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:compute_systems_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Hitachi » Automation Director
Versions before (<) 8.6.2-00
cpe:2.3:a:hitachi:automation_director:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Hitachi » Infrastructure Analytics Advisor
Versions before (<) 4.2.0-00
cpe:2.3:a:hitachi:infrastructure_analytics_advisor:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-21033

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-21033

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.0	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N	3.1	1.4	MITRE
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: Low Integrity: None Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2018-21033

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-21033

https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/

Multiple Vulnerabilities in Hitachi Command Suite and Hitachi Infrastructure Analytics Advisor: Software Vulnerability Information: Software: Hitachi
Vendor Advisory

CVEs referencing this url
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/

Software Vulnerability Information: Software: Hitachi
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-21033

Products affected by CVE-2018-21033

Exploit prediction scoring system (EPSS) score for CVE-2018-21033

CVSS scores for CVE-2018-21033

CWE ids for CVE-2018-21033

References for CVE-2018-21033