CVE-2019-3747: Dell Integrated Data Protection Appliance, XSS

Описание

Оригинално описание

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.

Засегнати продукти

• Dell Integrated Data Protection Appliance: prior to 2.3

Вид слабост

• CWE-79 XSS

История

Други уязвимости в Dell Integrated Data Protection Appliance

• 7.9CVE-2020-5350
• 8.1CVE-2019-3765
• 9.8CVE-2019-3746
• 8.2CVE-2019-3736

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2019-3747
• https://nvd.nist.gov/vuln/detail/CVE-2019-3747
• https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities