Platform
other
Component
unisphere-for-powermax
Fixed in
9.1.0.9
9.0.2.16
CVE-2019-18588 describes a Cross-Site Scripting (XSS) vulnerability present in Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9 and 9.0.2.16. This vulnerability allows an authenticated malicious user to inject JavaScript code, potentially compromising the sessions of other authenticated users. The vulnerability was published on January 10, 2020, and a fix is available in versions 9.1.0.9 and 9.0.2.16.
The XSS vulnerability in Unisphere for PowerMax allows an authenticated attacker to inject arbitrary JavaScript code into web pages viewed by other authenticated users. This could lead to session hijacking, where the attacker gains control of another user's account. The attacker could also steal sensitive information displayed on the page, such as credentials or configuration data. Successful exploitation requires the attacker to be authenticated within the Unisphere environment, but once authenticated, the impact can be significant, potentially affecting multiple users and compromising the integrity of the PowerMax management interface. This type of XSS vulnerability can be particularly damaging in enterprise environments where privileged accounts are used.
While no active exploitation campaigns have been publicly reported for CVE-2019-18588, the vulnerability's CRITICAL severity and the potential for session hijacking make it a high-priority concern. The vulnerability is not currently listed on CISA KEV. Public proof-of-concept exploits are not widely available, but the XSS nature of the vulnerability means that exploitation is likely possible with moderate effort. The published date indicates a relatively early disclosure, giving attackers ample time to develop and deploy exploits.
Exploit Status
EPSS
0.53% (67% percentile)
CVSS Vector
The primary mitigation for CVE-2019-18588 is to upgrade Unisphere for PowerMax to version 9.1.0.9 or 9.0.2.16. Before upgrading, review the Dell EMC release notes for any potential compatibility issues or breaking changes. If an immediate upgrade is not possible, consider implementing strict input validation and output encoding on all user-supplied data within the Unisphere interface to reduce the attack surface. While not a complete fix, this can help prevent the injection of malicious scripts. Monitor Unisphere logs for any suspicious activity, such as unusual JavaScript execution patterns. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload through the Unisphere interface and verifying that it is properly sanitized.
Update Dell EMC Unisphere for PowerMax to version 9.1.0.9 or later, or to version 9.0.2.16 or later, as appropriate. This will resolve the Cross-Site Scripting (XSS) vulnerability.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2019-18588 is a critical Cross-Site Scripting (XSS) vulnerability in Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9 and 9.0.2.16, allowing authenticated attackers to inject JavaScript code.
You are affected if you are using Unisphere for PowerMax versions 9.1.0.9 or earlier, or 9.0.2.16 or earlier. Check your version against the affected versions listed in the advisory.
Upgrade to version 9.1.0.9 or 9.0.2.16. Review Dell EMC release notes before upgrading to ensure compatibility.
While no active exploitation campaigns have been publicly reported, the vulnerability's severity and potential impact warrant immediate attention and remediation.
Refer to the Dell EMC Security Advisory for CVE-2019-18588 on the Dell Support website for detailed information and mitigation steps.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.