PT-2022-19408 · Dell · Dell Unity+3

Published 2022-05-26 · Updated 2022-06-08 · CVE-2022-29091

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell Unity versions prior to 5.2.0.0.5.173 Dell UnityVSA versions prior to 5.2.0.0.5.173 Dell UnityXT versions prior to 5.2.0.0.5.173

Description The issue is a Reflected Cross-Site Scripting Vulnerability in the Unisphere GUI. An unauthenticated remote attacker could exploit this, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser. This may result in information disclosure, session theft, or client-side request forgery.

Recommendations For Dell Unity versions prior to 5.2.0.0.5.173, update to version 5.2.0.0.5.173 or later. For Dell UnityVSA versions prior to 5.2.0.0.5.173, update to version 5.2.0.0.5.173 or later. For Dell UnityXT versions prior to 5.2.0.0.5.173, update to version 5.2.0.0.5.173 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29091

Affected Products

Dell Unity

Dell Unityvsa

Dell Unity Xt

Unisphere Gui

References · 4

• https://osv.dev/vulnerability/CVE-2022-29091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29091 · Security Note
• https://dell.com/support/kbdoc/000199446 · Vendor Advisory
• https://t.me/cibsecurity/43404 · Telegram Post