Stored Cross-Site Scripting Vulnerability in Dell SCG Policy Manager Could Lead to Information Disclosure, Session Theft, or Client-Side Request Forgery

CVE-2024-24907

Summary

Dell Secure Connect Gateway (SCG) Policy Manager contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the Filters page. A high-privileged attacker on an adjacent network can exploit this flaw to store malicious HTML or JavaScript code within a trusted application data store. When an unsuspecting user accesses this data store via their web browser, the malicious code executes in the context of the web application. This exploitation can lead to significant security concerns, including unauthorized information disclosure, session theft, and the potential for client-side request forgery.

References