Stored XSS in field name data model

Last update: 2019-11-11

Advisory IDNN-2019:1-01
TopicStored XSS in field name data model
CWE ImpactCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Issue date2019-11-11
AffectsGuardian, CMC < v19.0.4
CVE Name(s)NA
CVSS detailsCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
CVSS Score7.6
CVE Risk LevelHigh
Risk Level for Nozomi customersMedium


An attacker with admin access to the appliance can inject malicious code that will later be executed by another legitimate users. This allows an attacker to perform unauthorized actions on behalf of legitimate users. JavaScript injection was possible using the field name when adding new column to the data model section. The injected code will then be executed in the environment section under e.g. asset view.


Guardian/CMC starting before v19.0.4 are affected.

Affected Products

Guardian, CMC < v19.0.4

Workarounds and Mitigations

Not required


Upgrade to v19.0.4

Modification History

2019-11-11: Initial revision

Related Links


Jonas Becker - Deloitte GmbH


Nozomi Networks Product Security team can be reached at prodsec@nozominetworks.com.
More contact details on the PSIRT page.