CVE-2021-21543: dell idrac9_firmware Cross-site Scripting
Vulnerability summary
CVE-2021-21543 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in dell idrac9_firmware. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities.
Timeline
- 30-04-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Dell2 products
- idrac9_firmware< 4.40.00.00
- integrated dell remote access controller (idrac)≥ unspecified, < 4.40.00.00
1 vendor · 2 products