PT-2022-21923 · Dell Emc · Dell Emc Data Protection Advisor

Published 2022-08-30 · Updated 2022-09-07 · CVE-2022-33935

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC Data Protection Advisor versions 19.6 and earlier

Description The issue is a Stored Cross Site Scripting, where an attacker could potentially exploit this to store malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. This may lead to information disclosure, session theft, or client-side request forgery.

Recommendations For Dell EMC Data Protection Advisor versions 19.6 and earlier, update to a version later than 19.6 to resolve the issue. As a temporary workaround, consider restricting access to the application data store to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-33935

Affected Products

Dell Emc Data Protection Advisor

References · 5

• https://osv.dev/vulnerability/CVE-2022-33935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33935 · Security Note
• https://dell.com/support/kbdoc/en-us/000201824/dsa-2022-107-dell-emc-data-protection-advisor-dpa-security-update-for-stored-cross-site-scripting-vulnerability · Vendor Advisory
• https://t.me/cibsecurity/49070 · Telegram Post
• https://t.me/cvenotify/35475 · Telegram Post