Stored Cross-Site Scripting Vulnerability in Dell SCG Policy Manager Could Lead to Information Disclosure, Session Theft, or Client-Side Request Forgery

CVE-2024-24905

Summary

Dell Secure Connect Gateway (SCG) Policy Manager contains a Stored Cross-Site Scripting vulnerability that can be exploited by high-privileged attackers on adjacent networks. The vulnerability allows for the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim accesses this data store via their browser, the malicious code executes in the context of the vulnerable application. This exploitation can lead to serious consequences, such as the disclosure of sensitive information, session theft, or client-side request forgery, posing significant risks to users and systems utilizing the affected software.

References