CVE-2024-28979

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28979
Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.dell.com/support/kbdoc/en-us/000224642/dsa-2024-202-security-update-for-dell-openmanage-enterprise-vulnerability Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:openmanage_enterprise:*:*:*:*:*:*:*:*
History

20 Aug 2024, 17:15

Type Values Removed Values Added
Summary (en) Dell OpenManage Enterprise, versions prior to 4.1.0, contains an XSS injection vulnerability in UI. A high privileged local attacker could potentially exploit this vulnerability, leading to JavaScript injection. (en) Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CWE CWE-20

23 May 2024, 19:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.1 		v2 : unknown
v3 : 4.8
Summary
  • (es) Dell OpenManage Enterprise, versiones anteriores a la 4.1.0, contiene una vulnerabilidad de inyección XSS en la interfaz de usuario. Un atacante local con privilegios elevados podría explotar esta vulnerabilidad, lo que provocaría una inyección de JavaScript.
References () https://www.dell.com/support/kbdoc/en-us/000224642/dsa-2024-202-security-update-for-dell-openmanage-enterprise-vulnerability - () https://www.dell.com/support/kbdoc/en-us/000224642/dsa-2024-202-security-update-for-dell-openmanage-enterprise-vulnerability - Vendor Advisory
CPE cpe:2.3:a:dell:openmanage_enterprise:*:*:*:*:*:*:*:*
CWE CWE-79
First Time Dell
Dell openmanage Enterprise

01 May 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-01 04:15

Updated : 2024-08-20 17:15

NVD link : CVE-2024-28979

Mitre link : CVE-2024-28979

CVE.ORG link : CVE-2024-28979

JSON object : View

Products Affected

dell

  • openmanage_enterprise
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')