CVE-2018-1000163

EUVD-2018-1866
Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Affected Products (NVD)
VendorProductVersion
projectfloodlightfloodlight
𝑥
≤ 1.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://xiaofen9.github.io/blog/floodlight-rce/
https://xiaofen9.github.io/blog/floodlight-rce/