PT-2023-29199 · Dell · Dell Dm5500

Published 2023-12-04 · Updated 2023-12-18 · CVE-2023-44301

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell DM5500 versions 5.14.0.0 and prior

Description A network attacker with low privileges could potentially exploit this issue, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Recommendations For versions 5.14.0.0 and prior, consider disabling the web application until a patch is available to prevent exploitation of the Reflected Cross-Site Scripting issue. Restrict access to the vulnerable web application to minimize the risk of exploitation. Avoid using the vulnerable web application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-44301

Affected Products

Dell Dm5500

References · 6

• https://osv.dev/vulnerability/CVE-2023-44301 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44301 · Security Note
• https://dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/CVEnew/status/1731597282460528641 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1731640823232516251 · Twitter Post
• https://t.me/cvenotify/62079 · Telegram Post