description: The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
vendor: hikvision
product: DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D
versions:
version: V2.X, status: affected, lessThanOrEqual: V2.3.8-6, versionType: custom
}
{
vendor: hikvision
product: DS-A71024/48R-CVS,DS-A72024/48R-CVS
versions:
version: V1.X, status: affected, lessThanOrEqual: V1.1.4 , versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
]
solutions: https://www.hikvision.com/content/dam/hikvision/en/support/cybersecyrity/security-advisory/Patch-for-Fixing-Security-Vulnerability-of-Hybrid-SAN-&-Cluster-Storage.zip