Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains a cross-site scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to script injection. This could allow unauthorized actions to be performed on the affected system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.9 | CVE-2026-28263 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By crafting a malicious script and injecting it into the application, the attacker can execute arbitrary code in the context of the user, potentially leading to unauthorized access or data manipulation.
Affected Products
- Feature Release versions 7.7.1.0 through 8.5
- LTS2025 release version 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.50
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Users should also ensure that access controls are in place to limit remote access to the affected systems and monitor for any suspicious activity.