SB2018112611 - Privilege escalation in Intel RAID Web Console

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2018-3699)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

The disclosed vulnerability allows an adjacent attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. An adjacent attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability results in privilege escalation.

2) Authentication bypass (CVE-ID: CVE-2018-3696)

CWE-ID: CWE-592 - Authentication Bypass Issues

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The disclosed vulnerability allows a local attacker to bypass authentication.

The vulnerability exists due to unspecified flaw. A local attacker can bypass authentication and gain administrative privileges via local access.

Remediation

Install update from vendor's website.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00199.html
• https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00196.html