Dell Unisphere for PowerMax vApp Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in Dell Unisphere for PowerMax vApp, version 9.2.4.x. This vulnerability arises from improper input neutralization during web page generation, allowing a low-privileged attacker with remote access to execute malicious HTML or JavaScript in the context of the affected web application. Exploitation could lead to information disclosure, session theft, or client-side request forgery.

Impact

Exploitation of this vulnerability could result in the execution of malicious scripts in the context of the victim user's browser, potentially leading to session theft, information disclosure, or client-side request forgery.

Remediation

Users can upgrade to Dell Unisphere for PowerMax version 9.2.4.19 or later. Instructions for downloading the update are available on the Dell Unisphere for PowerMax Drivers page.