CVE-2018-9080
N/A
N/A
Summary
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Lenovo Group LTD | Iomega StorCenter | 4.1.402.34662 <= 4.1.402.34662 | affected |
| Lenovo Group LTD | LenovoEMC | 4.1.402.34662 <= 4.1.402.34662 | affected |
| Lenovo Group LTD | EZ Media and Backup Center | 4.1.402.34662 <= 4.1.402.34662 | affected |
Weaknesses
- Session fixation
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.