Details of VAR-202104-0683

ID

VAR-202104-0683

CVE

CVE-2021-21543

TITLE

Dell EMC iDRAC9 Cross-site scripting vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202104-2305

DESCRIPTION

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. DELL Dell EMC iDRAC9 is a set of system management solutions including hardware and software from Dell (DELL). This solution provides functions such as remote management, crash recovery and power control for Dell PowerEdge systems

Trust: 1.08

sources: NVD: CVE-2021-21543 // VULHUB: VHN-379947 // VULMON: CVE-2021-21543

AFFECTED PRODUCTS

vendor:

dell

model:

idrac9

scope:

version:

4.40.00.00

Trust: 1.0

sources: NVD: CVE-2021-21543

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-21543
value:	MEDIUM
Trust: 1.0
security_alert@emc.com:	CVE-2021-21543
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-202104-2305
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-379947
value:	LOW
Trust: 0.1
VULMON:	CVE-2021-21543
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2021-21543
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
VULHUB:	VHN-379947
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-21543
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 2.0

sources: VULHUB: VHN-379947 // VULMON: CVE-2021-21543 // CNNVD: CNNVD-202104-2305 // NVD: CVE-2021-21543 // NVD: CVE-2021-21543

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.1

sources: VULHUB: VHN-379947 // NVD: CVE-2021-21543

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202104-2305

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202104-2305

PATCH

title:

Dell EMC iDRAC9 Fixes for cross-site scripting vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=149951

Trust: 0.6

sources: CNNVD: CNNVD-202104-2305

EXTERNAL IDS

db:	NVD	id:	CVE-2021-21543	Trust: 1.8
db:	CNNVD	id:	CNNVD-202104-2305	Trust: 0.6
db:	VULHUB	id:	VHN-379947	Trust: 0.1
db:	VULMON	id:	CVE-2021-21543	Trust: 0.1

sources: VULHUB: VHN-379947 // VULMON: CVE-2021-21543 // CNNVD: CNNVD-202104-2305 // NVD: CVE-2021-21543

REFERENCES

url:	https://www.dell.com/support/kbdoc/000185293	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-21543	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-379947 // VULMON: CVE-2021-21543 // CNNVD: CNNVD-202104-2305 // NVD: CVE-2021-21543

SOURCES

db:	VULHUB	id:	VHN-379947
db:	VULMON	id:	CVE-2021-21543
db:	CNNVD	id:	CNNVD-202104-2305
db:	NVD	id:	CVE-2021-21543

LAST UPDATE DATE

2024-08-14T15:06:50.761000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-379947	date:	2021-05-10T00:00:00
db:	VULMON	id:	CVE-2021-21543	date:	2021-05-10T00:00:00
db:	CNNVD	id:	CNNVD-202104-2305	date:	2021-05-11T00:00:00
db:	NVD	id:	CVE-2021-21543	date:	2021-05-10T17:49:02.367

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-379947	date:	2021-04-30T00:00:00
db:	VULMON	id:	CVE-2021-21543	date:	2021-04-30T00:00:00
db:	CNNVD	id:	CNNVD-202104-2305	date:	2021-04-30T00:00:00
db:	NVD	id:	CVE-2021-21543	date:	2021-04-30T21:15:08.860