Cross site scripting

2013-09-2410:35:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.3%

JSON

Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.

CPENameOperatorVersion
idrac6_firmwarele1.95
idrac6_firmwareeq1.0
idrac6_firmwareeq1.1
idrac6_firmwareeq1.2
idrac6_firmwareeq1.3
idrac6_firmwareeq1.5
idrac6_firmwareeq1.6
idrac6_firmwareeq1.8
idrac7_firmwarele1.40.40
idrac7_firmwareeq1.00.00

Name	Operator	Version
idrac6_firmware	le	1.95
idrac6_firmware	eq	1.0
idrac6_firmware	eq	1.1
idrac6_firmware	eq	1.2
idrac6_firmware	eq	1.3
idrac6_firmware	eq	1.5
idrac6_firmware	eq	1.6
idrac6_firmware	eq	1.8
idrac7_firmware	le	1.40.40
idrac7_firmware	eq	1.00.00