CVE-2022-29095 Cross-site scripting in SupportAssist Consumer

What is CVE-2022-29095?

CVE-2022-29095 is a high-severity cross-site scripting vulnerability in Dell SupportAssist Consumer, published on 10 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripting vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability under specific conditions leading to execution of malicious code on a vulnerable system.

Weakness: CWE-79, CWE-16

Which versions are affected by CVE-2022-29095?

It affects 2 products.

Products include Dell Supportassist for Business Pcs, Dell Supportassist for Home Pcs.

How do I fix CVE-2022-29095?

No fix has been published for CVE-2022-29095 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-29095 being exploited?

There is no known exploitation of CVE-2022-29095 in the wild and no public exploit code.

Other vulnerabilities in Dell SupportAssist Consumer

• CVE-2023-44283 Privilege escalation in SupportAssist for Business PCs High 7.8
• CVE-2022-29092 Privilege escalation in SupportAssist Consumer High 7.8
• CVE-2020-5316 Other in Dell SupportAssist Client High 7.8
• CVE-2019-12280 Path traversal in n/a High 7.8
• CVE-2024-52535 Path traversal in SupportAssist for Business PCs High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qp6v-78xh-69g5.