PT-2025-5900 · Dell · Dell Update Manager Plugin

Published 2025-02-07 · Updated 2025-03-04 · CVE-2025-22402

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dell Update Manager Plugin versions 1.5.0 through 1.6.0

Description The issue is related to an Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic Cross-Site Scripting (XSS). This could allow a low-privileged attacker with remote access to potentially exploit the vulnerability, leading to information exposure.

Recommendations For versions 1.5.0 through 1.6.0, update to a version that contains the fix for this issue to prevent potential attacks. As a temporary workaround, consider restricting access to sensitive data until a patch is available. Avoid using the plugin until the issue is resolved to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-22402

Affected Products

Dell Update Manager Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-22402 · Security Note
• https://dell.com/support/kbdoc/en-us/000281885/dsa-2025-047-security-update-for-dell-update-manager-plugin-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-22402 · Vendor Advisory
• https://twitter.com/IseleyeNimi/status/1889072046103007314 · Twitter Post
• https://twitter.com/CVEnew/status/1887697595432091727 · Twitter Post
• https://twitter.com/Hosainfosec/status/1888834263979602404 · Twitter Post
• https://t.me/cvedetector/17463 · Telegram Post
• https://twitter.com/dailycve/status/1896980825289424939 · Twitter Post
• https://twitter.com/WhalersLtd/status/1887743733048672598 · Twitter Post