CVE-2018-18985

NONE EPSS 57.6%
Published Jan 29, 20197y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jan 29, 2019 7y ago
Last Modified Jun 17, 2026 2w ago

Description

Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.

Threat Intelligence

EPSS Exploit Probability
57.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 7

VendorProductVersionRange
tridiumniagara* <4.4.93.40.2
tridiumniagara*≥4.6  –  <4.6.96.28.4
tridiumniagara4.4u2any
tridiumniagara_ax_framework* <3.8.401.1
tridiumniagara_ax_framework3.8u4any
tridiumniagara_enterprise_security* <2.3.118.6
tridiumniagara_enterprise_security2.3u1any

References 2

  • securityfocus.com http://www.securityfocus.com/bid/106530
    Third Party AdvisoryVDB Entry
  • ics-cert.us-cert.gov https://ics-cert.us-cert.gov/advisories/ICSA-18-333-02
    Third Party AdvisoryUS Government Resource

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.