Details of VAR-202001-0727

ID

VAR-202001-0727

CVE

CVE-2019-18588

TITLE

Dell EMC Unisphere for PowerMax and PowerMax OS Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2019-014167

DESCRIPTION

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users' sessions. Dell EMC Unisphere for PowerMax is a set of graphical management tools for PowerMax storage arrays developed by Dell. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Trust: 1.71

sources: NVD: CVE-2019-18588 // JVNDB: JVNDB-2019-014167 // VULHUB: VHN-150949

AFFECTED PRODUCTS

vendor:	dell	model:	emc powermax	scope:	eq	version:	5978.221.221	Trust: 2.4
vendor:	dell	model:	emc powermax	scope:	eq	version:	5978.479.479	Trust: 2.4
vendor:	dell	model:	emc unisphere for powermax	scope:	lt	version:	9.0.2.16	Trust: 1.0
vendor:	dell	model:	emc unisphere for powermax	scope:	gte	version:	9.1.0.0	Trust: 1.0
vendor:	dell	model:	emc unisphere for powermax	scope:	lt	version:	9.1.0.9	Trust: 1.0
vendor:	dell	model:	emc unisphere	scope:	lt	version:	for powermax 9.0.2.16	Trust: 0.8
vendor:	dell	model:	emc unisphere	scope:	lt	version:	for powermax 9.1.0.9	Trust: 0.8

sources: JVNDB: JVNDB-2019-014167 // CNNVD: CNNVD-201912-969 // NVD: CVE-2019-18588

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-18588
value:	MEDIUM
Trust: 1.0
security_alert@emc.com:	CVE-2019-18588
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-18588
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201912-969
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-150949
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2019-18588
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-150949
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-18588
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 1.0
security_alert@emc.com:	CVE-2019-18588
baseSeverity:	CRITICAL
baseScore:	9.0
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.3
impactScore:	6.0
version:	3.0
Trust: 1.0
NVD:	CVE-2019-18588
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-150949 // JVNDB: JVNDB-2019-014167 // CNNVD: CNNVD-201912-969 // NVD: CVE-2019-18588 // NVD: CVE-2019-18588

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-150949 // JVNDB: JVNDB-2019-014167 // NVD: CVE-2019-18588

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201912-969

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201912-969

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-014167

PATCH

title:

DSA-2019-193: Dell EMC Unisphere for PowerMax and Dell EMC PowerMax Embedded Management Cross-Site Scripting (XSS) Vulnerability

url:

https://www.dell.com/support/security/ja-jp/details/539808/DSA-2019-193-Dell-EMC-Unisphere-for-PowerMax-and-Dell-EMC-PowerMax-Embedded-Management-Cross-Site

Trust: 0.8

sources: JVNDB: JVNDB-2019-014167

EXTERNAL IDS

db:	NVD	id:	CVE-2019-18588	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-014167	Trust: 0.8
db:	CNNVD	id:	CNNVD-201912-969	Trust: 0.7
db:	CNVD	id:	CNVD-2020-03035	Trust: 0.1
db:	VULHUB	id:	VHN-150949	Trust: 0.1

sources: VULHUB: VHN-150949 // JVNDB: JVNDB-2019-014167 // CNNVD: CNNVD-201912-969 // NVD: CVE-2019-18588

REFERENCES

url:	https://www.dell.com/support/security/en-us/details/539808/dsa-2019-193-dell-emc-unisphere-for-powermax-and-dell-emc-powermax-embedded-management-cross-site	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-18588	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-18588	Trust: 0.8
url:	https://vigilance.fr/vulnerability/dell-emc-unisphere-for-powermax-cross-site-scripting-31196	Trust: 0.6

sources: VULHUB: VHN-150949 // JVNDB: JVNDB-2019-014167 // CNNVD: CNNVD-201912-969 // NVD: CVE-2019-18588

SOURCES

db:	VULHUB	id:	VHN-150949
db:	JVNDB	id:	JVNDB-2019-014167
db:	CNNVD	id:	CNNVD-201912-969
db:	NVD	id:	CVE-2019-18588

LAST UPDATE DATE

2024-11-23T22:16:40.377000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-150949	date:	2020-01-22T00:00:00
db:	JVNDB	id:	JVNDB-2019-014167	date:	2020-02-05T00:00:00
db:	CNNVD	id:	CNNVD-201912-969	date:	2020-01-19T00:00:00
db:	NVD	id:	CVE-2019-18588	date:	2024-11-21T04:33:20.630

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-150949	date:	2020-01-10T00:00:00
db:	JVNDB	id:	JVNDB-2019-014167	date:	2020-02-05T00:00:00
db:	CNNVD	id:	CNNVD-201912-969	date:	2019-12-20T00:00:00
db:	NVD	id:	CVE-2019-18588	date:	2020-01-10T19:15:11.797