SB2018112611 - Privilege escalation in Intel RAID Web Console

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2018-3699)

The disclosed vulnerability allows an adjacent attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. An adjacent attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability results in privilege escalation.

2) Authentication bypass (CVE-ID: CVE-2018-3696)

The disclosed vulnerability allows a local attacker to bypass authentication.

The vulnerability exists due to unspecified flaw. A local attacker can bypass authentication and gain administrative privileges via local access.

Remediation

Install update from vendor's website.

References

• https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00199.html
• https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00196.html