CVE-2018-8827

The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS.
References
Link Resource
http://45.32.113.185/075a6fa2d5db3bf3457896bee6db6787.html Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:technicolor:tg789vac_firmware:16.3.7190-2761005-20161004084353:*:*:*:*:*:*:*
cpe:2.3:h:technicolor:tg789vac:2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-01-03 23:29

Updated : 2024-02-28 16:48


NVD link : CVE-2018-8827

Mitre link : CVE-2018-8827

CVE.ORG link : CVE-2018-8827


JSON object : View

Products Affected

technicolor

  • tg789vac_firmware
  • tg789vac
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')