CVE-2024-25971 XML external entity in PowerProtect Data Manager
A remote high-privileged attacker can exploit an XML External Entity vulnerability in Dell PowerProtect Data Manager to disclose information or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25971?
CVE-2024-25971 is a medium-severity vulnerability in Dell PowerProtect Data Manager, published on 28 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.
Weakness: CWE-611
Which versions are affected by CVE-2024-25971?
It affects 1 product.
Products include Dell Powerprotect Data Manager.
How do I fix CVE-2024-25971?
No fix has been published for CVE-2024-25971 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-25971 being exploited?
There is no known exploitation of CVE-2024-25971 in the wild and no public exploit code.
Other vulnerabilities in Dell PowerProtect Data Manager
- CVE-2026-40712 Privilege escalation in PowerProtect Data Manager
- CVE-2026-46738 Privilege escalation in PowerProtect Data Manager
- CVE-2026-49499 Privilege escalation in PowerProtect Data Manager
- CVE-2025-43888 Information disclosure in PowerProtect Data Manager
- CVE-2024-22454 Auth bypass in PowerProtect Data Manager
Sources
Also known as GHSA-jpx5-qv8q-fwxp.