PT-2025-19886 · Dell · Dell Storage Manager

Published 2025-05-05 · Updated 2025-05-07 · CVE-2025-22478

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dell Storage Center - Dell Storage Manager version 20.1.20

Description The issue is related to an Improper Restriction of XML External Entity Reference, which could be exploited by an unauthenticated attacker with adjacent network access. This could lead to information disclosure and information tampering.

Recommendations For version 20.1.20, update to a version that addresses the Improper Restriction of XML External Entity Reference vulnerability. As a temporary workaround, consider restricting access to the XML external entity references to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-06844

CVE-2025-22478

Affected Products

Dell Storage Manager

References · 9

• https://bdu.fstec.ru/vul/2025-06844 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22478 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22478 · Security Note
• https://t.me/latest_high_impact_cve/2290 · Telegram Post
• https://t.me/cvedetector/24639 · Telegram Post
• https://dell.com/support/kbdoc/ru-ru/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities · Note
• https://twitter.com/cybercronai/status/1920263760972746856 · Twitter Post
• https://twitter.com/CVEnew/status/1919788757999308968 · Twitter Post