Overview
Dell OpenManage Server Administrator version 7.1 and earlier contains a cross-site scripting vulnerability.
Description
Dell OpenManage Server Administrator version 7.1 and earlier contains a cross-site scripting vulnerability (CWE-79). |
Impact
A remote attacker may be able to execute arbitrary script in the context of the end-user's browser session. |
Solution
Apply an Update Users should download the appropriate patch for the version of OpenManage they have installed. |
Restrict Access |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| Temporal | 3.9 | E:POC/RL:OF/RC:C |
| Environmental | 2.9 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
References
- http://cwe.mitre.org/data/definitions/79.html
- http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=5JDN0&osCode=WNET&fileId=3082293694
- http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=PCXMR&osCode=WNET&fileId=3082295344
- http://www.dell.com/support/drivers/us/en/19/DriverDetails/Product/poweredge-r710?driverId=JJMWP&osCode=WNET&fileId=3082295338
Acknowledgements
Thanks to David Ferrest and Dell for reporting this vulnerability.
This document was written by Jared Allar.
Other Information
| CVE IDs: | CVE-2012-4955 |
| Date Public: | 2012-10-31 |
| Date First Published: | 2012-11-14 |
| Date Last Updated: | 2012-11-14 14:48 UTC |
| Document Revision: | 12 |