PT-2024-2772 · Dell · Dell Unity

Published 2024-02-12 · Updated 2024-02-15 · CVE-2024-22230

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell Unity versions prior to 5.4

Description The issue is related to a Cross-site scripting vulnerability. An authenticated attacker could potentially exploit this vulnerability, stealing session information, masquerading as the affected user, or carrying out any actions that this user could perform, to generally control the victim's browser. The vulnerability exists due to inadequate protection of the web page structure, allowing a remote attacker to disclose protected session information or execute arbitrary code on behalf of the user.

Recommendations For versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02910

CVE-2024-22230

Affected Products

Dell Unity

References · 7

• https://osv.dev/vulnerability/CVE-2024-22230 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02910 · Security Note
• https://dell.com/support/kbdoc/en-us/000222010/dsa-2024-042-dell-unity-dell-unity-vsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22230 · Security Note
• https://twitter.com/VulmonFeeds/status/1757156027265380862 · Twitter Post
• https://t.me/cvenotify/71114 · Telegram Post
• https://twitter.com/CVEnew/status/1757115423860854822 · Twitter Post