PT-2024-20656 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Kosmosec · Published 2024-03-01 · Updated 2025-05-20 · CVE-2024-24905

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway (SCG) Policy Manager, all versions

Description The issue is a Stored Cross-Site Scripting Vulnerability that could be exploited by an adjacent network high privileged attacker, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. This may lead to information disclosure, session theft, or client-side request forgery.

Recommendations As a temporary workaround, consider restricting access to the vulnerable application until a patch is available. Restrict access to the data store to minimize the risk of exploitation. Avoid using the vulnerable web application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24905

Affected Products

Dell Secure Connect Gateway (Scg) Policy Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-24905 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24905 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000222330/dsa-2024-077-security-update-for-dell-secure-connect-gateway-policy-manager-vulnerabilities · Vendor Advisory
• https://t.me/cvenotify/72789 · Telegram Post
• https://twitter.com/cracbot/status/1764024189843808738 · Twitter Post
• https://twitter.com/dailycve/status/1864753560589676874 · Twitter Post
• https://t.me/cvenotify/123112 · Telegram Post