CVE-2018-21033

Published: Feb 14, 2020Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager.

Affected (8)

Products: Hitachi: Device Manager, Compute Systems Manager, Automation Director, Tiered Storage Manager, Replication Manager, Tuning Manager, Global Link Manager, Infrastructure Analytics Advisor

Hitachi

8 products

Device Manager

Compute Systems Manager

Automation Director

Tiered Storage Manager

Replication Manager

Tuning Manager

Global Link Manager

Infrastructure Analytics Advisor

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hitachi Device Manager	Before 8.6.2-00

Running on/with	Platform Versions
Oracle Solaris	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Compute Systems Manager	Before 8.6.2-00

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Automation Director	Before 8.6.2-00

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Tiered Storage Manager	Before 8.6.2-00

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Replication Manager	Before 8.6.2-00

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Tuning Manager	Before 8.6.2-00

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Hitachi Global Link Manager	Before 8.6.2-00

Configuration H

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Hitachi Infrastructure Analytics Advisor	Before 4.2.0-00

Running on/with	Platform Versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/

Source: cve@mitre.org

Vendor Advisory

https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/

Source: cve@mitre.org

Vendor Advisory

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.