CVE-2018-18370

CVE-2018-18370 describes a stored cross-site scripting (XSS) vulnerability in the WebFTP mode of Broadcom ASG and ProxySG appliances, affecting versions 6.6 and 6.7 prior to 6.7.4.2, and ProxySG 6.5 prior to 6.5.10.15. An attacker can inject malicious JavaScript into the web listing of a remote FTP server by uploading crafted files to that server, which then executes in a user's browser when they access the FTP server via a web browser. The vulnerability has a CVSSv3 score of 6.1 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. The EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.