Stored Cross-Site Scripting Vulnerability in Dell SCG Policy Manager Could Lead to Information Disclosure, Session Theft, or Client-Side Request Forgery

CVE-2024-24904

What is CVE-2024-24904?

The Dell Secure Connect Gateway (SCG) Policy Manager exhibits a vulnerability that allows for stored cross-site scripting (XSS) attacks. This issue enables high-privileged attackers in adjacent networks to inject malicious HTML or JavaScript into a trusted application data store. When users interact with the affected application, the injected code can execute in their web browsers, potentially leading to serious consequences including information disclosure, session theft, and client-side request forgery. Organizations using the Dell SCG Policy Manager should prioritize applying available updates to mitigate this vulnerability.

References