PT-2022-18113 · Dell · Dell Powerstore

Published 2022-06-02 · Updated 2022-06-13 · CVE-2022-26866

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell PowerStore versions prior to v2.1.1.0

Description The issue is a Stored Cross-Site Scripting vulnerability that can be exploited by a high privileged network attacker, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browser, the malicious code gets executed by the web browser in the context of the vulnerable web application. This may lead to information disclosure, session theft, or client-side request forgery.

Recommendations For versions prior to v2.1.1.0, update to version v2.1.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable web application to minimize the risk of exploitation. Avoid using the vulnerable application until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-26866

Affected Products

Dell Powerstore

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-26866 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26866 · Vendor Advisory
• https://dell.com/support/kbdoc/000196367 · Vendor Advisory
• https://t.me/cvenotify/31060 · Telegram Post
• https://t.me/cibsecurity/43782 · Telegram Post