VulnerabilityModified
CVE-2018-19391
Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.
MEDIUM 6.1EPSS 0.73%
Does this matter?
Lower severity and a low EPSS score (0.73%). Track it; it rarely justifies an emergency change on its own.
Description
Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.73% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- cobham/satcom sailor 250 firmware · cobham/satcom sailor 500 firmware
- Source
- cve@mitre.org
References
- https://cyberskr.com/blog/cobham-satcom-250-500.htmlExploit, Third Party Advisory
- https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0Third Party Advisory
- https://cyberskr.com/blog/cobham-satcom-250-500.htmlExploit, Third Party Advisory
- https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.