PT-2021-14626 · Dell · Dell Emc Idrac8+1

Jameel Nabbo · Published 2021-08-03 · Updated 2021-08-09 · CVE-2021-21580

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC8 versions prior to 2.80.80.80 Dell EMC iDRAC9 versions prior to 5.00.00.00

Description The issue is related to content spoofing and text injection, where a malicious URL can inject text to present a customized message on the application. This can lead to phishing attacks, making users believe the message is legitimate. A malicious URL can be used to inject text and present a customized message.

Recommendations For Dell EMC iDRAC8 versions prior to 2.80.80.80, update to version 2.80.80.80 or later. For Dell EMC iDRAC9 versions prior to 5.00.00.00, update to version 5.00.00.00 or later. As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation. Avoid using malicious URLs in the application until the issue is resolved.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-21580

Affected Products

Dell Emc Idrac8

Dell Emc Idrac9

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-21580 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21580 · Vendor Advisory
• https://dell.com/support/kbdoc/000189193 · Vendor Advisory
• https://t.me/cibsecurity/26766 · Telegram Post
• https://t.me/cvenotify/18925 · Telegram Post