CVE-2022-29095: dell supportassist consumer Configuration
Vulnerability summary
CVE-2022-29095 is a critical (CVSS 9.6) Configuration vulnerability in dell supportassist consumer. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68.1% of scored vulnerabilities.
Timeline
- 10-06-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripting vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability under specific conditions leading to execution of malicious code on a vulnerable system.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.21%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 1.18% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-16ConfigurationWeaknesses in this category are typically introduced during the configuration of the software.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Dell3 products
- supportassist consumer≥ unspecified, ≤ 3.10.4
- supportassist_for_business_pcs≤ 3.1.1
- supportassist_for_home_pcs≤ 3.10.4
1 vendor · 3 products