CVE-2019-3490

Name of the Vulnerable Software and Affected Versions Open Enterprise Server (OES) versions OES2015SP1, OES2018, and OES2018SP1

Description A DOM based XSS issue has been identified in the Netstorage component, allowing a remote attacker to execute javascript in the victim's browser by tricking the victim into clicking on a specially crafted link.

Recommendations For OES2015SP1, update to a version that includes the fix for this issue. For OES2018, update to a version that includes the fix for this issue. For OES2018SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Netstorage component until a patch is available.