Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a high privileged victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery
References
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
03 Feb 2025, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dell dd9900
Dell dm5500 Dell dd6400 Dell data Domain Operating System Dell dd9910 Dell dd3300 Dell Dell dd9400 Dell dd6900 Dell dd9410 |
|
| References | () https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities - Vendor Advisory | |
| CPE | cpe:2.3:h:dell:dm5500:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd3300:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd9910:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd9410:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd6400:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd9900:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd6900:-:*:*:*:*:*:*:* cpe:2.3:h:dell:dd9400:-:*:*:*:*:*:*:* cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:* |
Information
Published : 2024-06-26 03:15
Updated : 2025-02-03 14:59
NVD link : CVE-2024-28973
Mitre link : CVE-2024-28973
CVE.ORG link : CVE-2024-28973
JSON object : View
Products Affected
dell
- dd9910
- dd9400
- dd6400
- data_domain_operating_system
- dd9900
- dm5500
- dd6900
- dd3300
- dd9410
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')