Product:
Unisphere for PowerMax
Summary
Dell Unisphere for PowerMax vApp contains an Improper Neutralization of Input During Web Page Generation vulnerability. A low privileged attacker with remote access could exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user’s web browser. This may result in information disclosure, session theft, or client-side request forgery.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-23861 |
Exploitation
To exploit this vulnerability, an attacker must have low privileges and remote access to the vulnerable web application. By crafting a malicious input that is not properly sanitized, the attacker can inject harmful HTML or JavaScript code. When a victim user interacts with the compromised web application, the malicious code executes in their browser, potentially leading to unauthorized actions or data exposure.
Affected Products
- Unisphere for PowerMax vApp: Contains a vulnerability that allows for cross-site scripting, enabling attackers to execute malicious scripts in user browsers.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Dell Unisphere for PowerMax and apply any available security updates. Additionally, implementing input validation and output encoding can help prevent cross-site scripting attacks.