Details of VAR-201909-0094

ID

VAR-201909-0094

CVE

CVE-2019-3754

TITLE

plural Dell EMC Product cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-008778

DESCRIPTION

Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser. Dell EMC Unity, etc. are the products of the United States Dell (Dell). EMC UnityVSA is a set of virtual EMC Unity storage environments. EMC VNXe3200 is a 2U dual-controller unified storage product. The vulnerability stems from the lack of proper validation of client data by web applications. An attacker could use this vulnerability to execute client code

Trust: 2.34

sources: NVD: CVE-2019-3754 // JVNDB: JVNDB-2019-008778 // CNVD: CNVD-2020-15718 // VULHUB: VHN-155189 // VULMON: CVE-2019-3754

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-15718

AFFECTED PRODUCTS

vendor:	dell	model:	emc vnxe3200	scope:	lt	version:	3.1.10.9946299	Trust: 2.4
vendor:	dell	model:	emc unity operating environment	scope:	lt	version:	5.0.0.0.5.116	Trust: 1.8
vendor:	dell	model:	emc unityvsa operating environment	scope:	lt	version:	5.0.0.0.5.116	Trust: 1.8
vendor:	dell	model:	emc unityvsa	scope:	lt	version:	5.0.0.0.5.116	Trust: 0.6
vendor:	dell	model:	emc unity	scope:	lt	version:	5.0.0.0.5.116	Trust: 0.6

sources: CNVD: CNVD-2020-15718 // JVNDB: JVNDB-2019-008778 // NVD: CVE-2019-3754

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-3754
value:	MEDIUM
Trust: 1.0
security_alert@emc.com:	CVE-2019-3754
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-3754
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-15718
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201908-2170
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-155189
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2019-3754
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-3754
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-15718
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-155189
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-3754
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8
security_alert@emc.com:	CVE-2019-3754
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	1.4
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2020-15718 // VULHUB: VHN-155189 // VULMON: CVE-2019-3754 // JVNDB: JVNDB-2019-008778 // CNNVD: CNNVD-201908-2170 // NVD: CVE-2019-3754 // NVD: CVE-2019-3754

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-155189 // JVNDB: JVNDB-2019-008778 // NVD: CVE-2019-3754

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201908-2170

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201908-2170

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-008778

PATCH

title:	DSA-2019-125: Dell EMC Unity and VNXe3200 Family Reflected Cross-Site Scripting Vulnerability	url:	https://www.dell.com/support/security/ja-jp/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability	Trust: 0.8
title:	Patch for Dell EMC Unity, EMC UnityVSA, and EMC VNXe3200 Cross-Site Scripting Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/207375	Trust: 0.6
title:	Dell EMC VNXe3200 Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=97654	Trust: 0.6

sources: CNVD: CNVD-2020-15718 // JVNDB: JVNDB-2019-008778 // CNNVD: CNNVD-201908-2170

EXTERNAL IDS

db:	NVD	id:	CVE-2019-3754	Trust: 3.2
db:	JVNDB	id:	JVNDB-2019-008778	Trust: 0.8
db:	CNVD	id:	CNVD-2020-15718	Trust: 0.7
db:	CNNVD	id:	CNNVD-201908-2170	Trust: 0.7
db:	VULHUB	id:	VHN-155189	Trust: 0.1
db:	VULMON	id:	CVE-2019-3754	Trust: 0.1

sources: CNVD: CNVD-2020-15718 // VULHUB: VHN-155189 // VULMON: CVE-2019-3754 // JVNDB: JVNDB-2019-008778 // CNNVD: CNNVD-201908-2170 // NVD: CVE-2019-3754

REFERENCES

url:	https://www.dell.com/support/security/en-us/details/536796/dsa-2019-125-dell-emc-unity-and-vnxe3200-family-reflected-cross-site-scripting-vulnerability	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2019-3754	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3754	Trust: 0.8
url:	https://vigilance.fr/vulnerability/dell-emc-vnxe3200-cross-site-scripting-via-cas-logout-page-30174	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-15718 // VULHUB: VHN-155189 // VULMON: CVE-2019-3754 // JVNDB: JVNDB-2019-008778 // CNNVD: CNNVD-201908-2170 // NVD: CVE-2019-3754

SOURCES

db:	CNVD	id:	CNVD-2020-15718
db:	VULHUB	id:	VHN-155189
db:	VULMON	id:	CVE-2019-3754
db:	JVNDB	id:	JVNDB-2019-008778
db:	CNNVD	id:	CNNVD-201908-2170
db:	NVD	id:	CVE-2019-3754

LAST UPDATE DATE

2024-11-23T22:44:54.344000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-15718	date:	2020-03-06T00:00:00
db:	VULHUB	id:	VHN-155189	date:	2019-10-09T00:00:00
db:	VULMON	id:	CVE-2019-3754	date:	2019-10-09T00:00:00
db:	JVNDB	id:	JVNDB-2019-008778	date:	2019-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201908-2170	date:	2019-09-05T00:00:00
db:	NVD	id:	CVE-2019-3754	date:	2024-11-21T04:42:28.160

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-15718	date:	2020-03-06T00:00:00
db:	VULHUB	id:	VHN-155189	date:	2019-09-03T00:00:00
db:	VULMON	id:	CVE-2019-3754	date:	2019-09-03T00:00:00
db:	JVNDB	id:	JVNDB-2019-008778	date:	2019-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201908-2170	date:	2019-08-28T00:00:00
db:	NVD	id:	CVE-2019-3754	date:	2019-09-03T17:15:11.273