Stored Cross-Site Scripting in Dell EMC Integrated Data Protection Appliance
CVE-2019-3747

8.4HIGH

Key Information:

Vendor

Dell
Status
Integrated Data Protection Appliance
Vendor
CVE Published:
27 September 2019

What is CVE-2019-3747?

The Dell EMC Integrated Data Protection Appliance prior to version 2.3 is susceptible to a stored cross-site scripting vulnerability. A remote attacker, with administrative access, can inject malicious HTML or JavaScript code into specific fields associated with the Cloud DR add-on. When targeted users access affected pages, their web browsers execute the injected code within the context of the compromised application, potentially leading to unauthorized actions and data exposure.

Affected Version(s)

Integrated Data Protection Appliance prior to 2.3

References

https://www.dell.com/support/security/en-us/details/53636...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.