CVE-2018-12300

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue allows attackers to disclose information in the Referer header via the 'state' URL parameter in echo-server.html. This is due to an arbitrary redirect in the affected software.

Recommendations For Seagate NAS OS version 4.3.15.1, avoid using the state URL parameter in the affected echo-server.html until the issue is resolved. As a temporary workaround, consider restricting access to the echo-server.html page to minimize the risk of exploitation.