Product:
Unisphere for PowerMax
Summary
Dell Unisphere for PowerMax contains an Improper Neutralization of Input During Web Page Generation vulnerability. A low privileged attacker with remote access could exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user’s web browser. This may result in information disclosure, session theft, or client-side request forgery.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-26357 |
Exploitation
To exploit this vulnerability, an attacker must have low privileges and remote access to the vulnerable web application. By injecting malicious HTML or JavaScript code into the web page, the attacker can manipulate the victim’s browser to execute the code, potentially leading to unauthorized access to sensitive information or session hijacking.
Affected Products
- Unisphere for PowerMax version 9.2.4.x – Contains the vulnerability allowing for cross-site scripting attacks.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Dell Unisphere for PowerMax and apply any available security updates. Additionally, implementing proper input validation and sanitization measures can help prevent exploitation of similar vulnerabilities.