CVE-2022-26866 Cross-site scripting in PowerStore
A high-privileged attacker can inject malicious scripts into Dell PowerStore, leading to information disclosure or session theft when victims access the interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-26866?
CVE-2022-26866 is a medium-severity cross-site scripting vulnerability in Dell PowerStore, published on 2 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
Weakness: CWE-79
Which versions are affected by CVE-2022-26866?
It affects 1 product.
Products include Dell Powerstoreos.
How do I fix CVE-2022-26866?
No fix has been published for CVE-2022-26866 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-26866 being exploited?
There is no known exploitation of CVE-2022-26866 in the wild and no public exploit code.
Other vulnerabilities in Dell PowerStore
Sources
Also known as GHSA-7h6f-6j9m-8x6g.