CVE-2023-44286

moderate-risk
Published 2023-12-14

Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the injection of malicious HTML or JavaScript code to a victim user's DOM environment in the browser. . Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Do I need to act?

-
0.16% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (9)

Powerprotect Data Protection
Apex Protection Storage
Powerprotect Data Domain
Powerprotect Data Domain Management Center
Emc Data Domain Os
Emc Data Domain Os
Emc Data Domain Os
Powerprotect Data Domain Management Center
Powerprotect Data Domain Management Center

Affected Vendors

46
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 1/34 · Minimal
Exposure 15/34 · Moderate