PT-2013-4499 · Dell · Dell Idrac7+1

Tudor Enache · Published 2013-09-24 · Updated 2013-09-25 · CVE-2013-3589

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dell iDRAC6 versions prior to 1.96 Dell iDRAC7 versions prior to 1.46.45

Description A cross-site scripting (XSS) issue exists in the login page of the Administrative Web Interface, allowing remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter. This could potentially lead to unauthorized actions on the affected device.

Recommendations For Dell iDRAC6 versions prior to 1.96, update the firmware to version 1.96 or later. For Dell iDRAC7 versions prior to 1.46.45, update the firmware to version 1.46.45 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-3589

Affected Products

Dell Idrac6

Dell Idrac7

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-3589 · Security Note
• http://kb.cert.org/vuls/id/BLUU-997QVW · Note
• http://kb.cert.org/vuls/id/920038 · Note