CVE-2018-12304

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue concerns cross-site scripting in the Application Manager. Attackers can execute JavaScript via multiple application metadata fields, including Short Description, Publisher Name, Publisher Contact, or Website URL.

Recommendations For Seagate NAS OS version 4.3.15.1, avoid using the vulnerable metadata fields until a patch is available. As a temporary workaround, consider restricting access to the Application Manager to minimize the risk of exploitation.