CVE-2023-44286

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-44286
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the injection of malicious HTML or JavaScript code to a victim user's DOM environment in the browser. . Exploitation may lead to information disclosure, session theft, or client-side request forgery.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:dell:powerprotect_data_protection:*:*:*:*:*:*:*:*
OR cpe:2.3:h:dell:dp4400:-:*:*:*:*:*:*:*
cpe:2.3:h:dell:dp5900:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:dell:apex_protection_storage:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:apex_protection_storage:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:virtual:*:*:*
cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:virtual:*:*:*
cpe:2.3:a:dell:powerprotect_data_domain_management_center:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:powerprotect_data_domain_management_center:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:emc_data_domain_os:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:emc_data_domain_os:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:emc_data_domain_os:*:*:*:*:lts2022:*:*:*
cpe:2.3:o:dell:emc_data_domain_os:*:*:*:*:lts2023:*:*:*
cpe:2.3:o:dell:powerprotect_data_domain_management_center:*:*:*:*:lts2022:*:*:*
cpe:2.3:o:dell:powerprotect_data_domain_management_center:*:*:*:*:lts2023:*:*:*
OR cpe:2.3:h:dell:dd3300:-:*:*:*:*:*:*:*
cpe:2.3:h:dell:dd6400:-:*:*:*:*:*:*:*
cpe:2.3:h:dell:dd6900:-:*:*:*:*:*:*:*
cpe:2.3:h:dell:dd9400:-:*:*:*:*:*:*:*
cpe:2.3:h:dell:dd9900:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2023-12-14 16:15

Updated : 2023-12-27 19:30

NVD link : CVE-2023-44286

Mitre link : CVE-2023-44286

CVE.ORG link : CVE-2023-44286

JSON object : View

Products Affected

dell

  • dd6400
  • powerprotect_data_protection
  • dd9400
  • dp4400
  • dd9900
  • emc_data_domain_os
  • dp5900
  • apex_protection_storage
  • powerprotect_data_domain
  • dd6900
  • powerprotect_data_domain_management_center
  • dd3300
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')