CVE-2019-9508 : Security Advisory and Response
Learn about CVE-2019-9508, a Medium severity Stored XSS vulnerability in Vertiv Avocent UMG-4000 version 4.2.1.19. Find out the impact, affected systems, and mitigation steps.
A Stored XSS vulnerability has been identified in the web interface of Vertiv Avocent UMG-4000 version 4.2.1.19, allowing remote attackers to execute malicious code.
Understanding CVE-2019-9508
This CVE involves a vulnerability in the web interface of Vertiv Avocent UMG-4000 version 4.2.1.19 that enables stored cross-site scripting attacks.
What is CVE-2019-9508?
- The vulnerability allows an authenticated remote attacker with administrator privileges to save a file with a malicious name on the web application.
- Each time a user visits the page, the malicious code within the file gets executed.
The Impact of CVE-2019-9508
- CVSS Base Score: 6.3 (Medium)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Confidentiality, Integrity, and Availability Impact: Low
- Vulnerability Type: CWE-79 Cross-site Scripting (XSS)
Technical Details of CVE-2019-9508
This section provides detailed technical information about the vulnerability.
Vulnerability Description
- The vulnerability lies in the web interface of Vertiv Avocent UMG-4000 version 4.2.1.19.
- It allows an attacker to store a file with a malicious name that executes malicious code when users access the page.
Affected Systems and Versions
- Affected Product: Avocent UMG-4000
- Vendor: Vertiv
- Affected Version: 4.2.1.19
Exploitation Mechanism
- An authenticated remote attacker with administrator privileges can exploit this vulnerability by saving a file with a malicious name on the web application.
Mitigation and Prevention
Protect your systems from CVE-2019-9508 with the following steps:
Immediate Steps to Take
- Apply the patches released by Vertiv Avocent for these vulnerabilities.
Long-Term Security Practices
- Regularly update and patch your systems to prevent known vulnerabilities.
Patching and Updates
- Trellis customers of the UMG running firmware v4.2.0.23 should install the update patch.
- Trellis users operating Trellis v5.0.6 and later should install Universal Gateway firmware version 4.3.0.23.