Description
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Lenovo Group | Iomega StorCenter | 4.1.402.34662 – ≤ 4.1.402.34662 | — |
| Lenovo Group | LenovoEMC | 4.1.402.34662 – ≤ 4.1.402.34662 | — |
| Lenovo Group | EZ Media and Backup Center | 4.1.402.34662 – ≤ 4.1.402.34662 | — |