CVE-2018-9080

CVSS V2 Medium 4.3 CVSS V3 Medium 5.9
Description
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
Overview
  • CVE ID
  • CVE-2018-9080
  • Assigner
  • psirt@lenovo.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2018-09-28T20:29:01
  • Last Modified Date
  • 2019-01-08T12:19:10
Weakness Enumerations
CWE URL
CWE-287 http://cwe.mitre.org/data/definitions/287.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:lenovo:storcenter_px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_px12-450r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_px12-400r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_px4-300r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_px6-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_px4-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_px2-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_ix4-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_ix2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storcenter_ix2-dl_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:storcenter_ix2-dl:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px12-450r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px12-450r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px12-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px12-400r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px4-400r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px4-400r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px4-300r_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px4-300r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px6-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px6-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px4-400d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px4-400d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px4-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:px2-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:px2-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:ix4-300d_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:ix4-300d:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:ix2_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:ix2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:ez_media_\&_backup_center_firmware:4.1.402.34662:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:ez_media_\&_backup_center:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • HIGH
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 5.9
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.2
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
https://support.lenovo.com/us/en/solutions/LEN-24224 Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2018-9080
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9080
History
Created Old Value New Value Data Type Notes
2022-05-10 17:48:34 Added to TrackCVE
2022-12-03 12:41:19 2018-09-28T20:29Z 2018-09-28T20:29:01 CVE Published Date updated
2022-12-03 12:41:19 2019-01-08T12:19:10 CVE Modified Date updated
2022-12-03 12:41:19 Analyzed Vulnerability Status updated