Description (CNA)
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Lenovo Group LTD / Iomega StorCenter | affected 4.1.402.34662 through 4.1.402.34662 |
| Lenovo Group LTD / LenovoEMC | affected 4.1.402.34662 through 4.1.402.34662 |
| Lenovo Group LTD / EZ Media and Backup Center | affected 4.1.402.34662 through 4.1.402.34662 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.