Detections
Analytics
Dell iDRAC6 / iDRAC7 Login Page 'ErrorMsg' Parameter XSS
medium Nessus Plugin ID 70411
Language:
Synopsis
The remote device is affected by a cross-site scripting vulnerability.Description
The remote Dell Remote Access Controller (iDRAC6 / iDRAC7) is affected by a cross-site scripting vulnerability in the login page due to improper sanitization of user-supplied input to the 'ErrorMsg' parameter. An attacker can exploit this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Note that iDRAC6 'modular' (blades) are not affected by this issue and no updates are required.
Solution
Upgrade to firmware version 1.96 (iDRAC6) / 1.46.45 (iDRAC7) or later.See Also
Plugin Details
Severity: Medium
ID: 70411
File Name: drac_errormsg_xss.nasl
Version: 1.6
Type: remote
Family: CGI abuses : XSS
Published: 10/13/2013
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/h:dell:remote_access_card, cpe:/o:dell:idrac6_firmware, cpe:/o:dell:idrac7_firmware
Required KB Items: installed_sw/iDRAC
Exploit Ease: No exploit is required
Patch Publication Date: 9/23/2013
Vulnerability Publication Date: 9/23/2013
Reference Information
CVE: CVE-2013-3589
BID: 62598