VulnerabilityModified

CVE-2021-22410

There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10.

MEDIUM 5.4EPSS 0.32%

Does this matter?

Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.

Description

There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. A module of the client does not verify the input sufficiently. Attackers can exploit this vulnerability by modifying input after logging onto the client. This may compromise the normal service of the client.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.32% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: huawei/imaster nce-fabric firmware
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-xss-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-xss-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.