CVE-2019-3747: dell emc_integrated_data_protection_appliance_firmware Cross-site Scripting
Vulnerability summary
CVE-2019-3747 is a high (CVSS 8.4) Cross-site Scripting vulnerability in dell emc_integrated_data_protection_appliance_firmware. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55% of scored vulnerabilities.
Timeline
- 27-09-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST8.4HighCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.78% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Dell2 products
- emc_integrated_data_protection_appliance_firmware2.0 | 2.1 | 2.2
- integrated data protection applianceprior to 2.3
1 vendor · 2 products