CVE-2019-3754 - OpenCVE

Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dell	Emc Unity Operating Environment Emc Unityvsa Operating Environment Emc Vnxe3200 Emc Vnxe3200 Firmware

Configuration 1 [-]

OR	cpe:2.3:a:dell:emc_unity_operating_environment::::::::
	cpe:2.3:a:dell:emc_unityvsa_operating_environment::::::::

Configuration 2 [-]

AND

cpe:2.3:o:dell:emc_vnxe3200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_vnxe3200:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability

History

No history.

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2019-09-03T16:52:53.915317Z

Updated: 2024-09-17T02:00:48.399Z

Reserved: 2019-01-03T00:00:00

Link: CVE-2019-3754

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-09-03T17:15:11.273

Modified: 2019-10-09T23:49:35.413

Link: CVE-2019-3754

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Unity Operating Environment", "vendor": "DELL EMC", "versions": [{"lessThan": "5.0.0.0.5.116", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "UnityVSA Operating Environment", "vendor": "DELL EMC", "versions": [{"lessThan": "5.0.0.0.5.116", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "VNXe3200 Operating Environment", "vendor": "DELL EMC", "versions": [{"lessThan": "3.1.10.9946299", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-08-27T00:00:00", "descriptions": [{"lang": "en", "value": "Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-09-03T16:52:53", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.7"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@dell.com", "DATE_PUBLIC": "2019-08-27T16:00:00.000Z", "ID": "CVE-2019-3754", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Unity Operating Environment", "version": {"version_data": [{"version_affected": "<", "version_value": "5.0.0.0.5.116"}]}}, {"product_name": "UnityVSA Operating Environment", "version": {"version_data": [{"version_affected": "<", "version_value": "5.0.0.0.5.116"}]}}, {"product_name": "VNXe3200 Operating Environment", "version": {"version_data": [{"version_affected": "<", "version_value": "3.1.10.9946299"}]}}]}, "vendor_name": "DELL EMC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser."}]}, "generator": {"engine": "Vulnogram 0.0.7"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability", "refsource": "CONFIRM", "url": "https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T19:19:18.181Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2019-3754", "datePublished": "2019-09-03T16:52:53.915317Z", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2024-09-17T02:00:48.399Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*", "matchCriteriaId": "7091DD01-04E8-4560-BE2B-CC0F009C3D17", "versionEndExcluding": "5.0.0.0.5.116", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAC14A15-77F9-4E6F-B900-6D3FBA241999", "versionEndExcluding": "5.0.0.0.5.116", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_vnxe3200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "61312D56-931F-488B-9563-2E1CBAF6F686", "versionEndExcluding": "3.1.10.9946299", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_vnxe3200:-:*:*:*:*:*:*:*", "matchCriteriaId": "3E2FB19C-F28D-4D99-B965-85CEE552D981", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser."}, {"lang": "es", "value": "Dell EMC Unity Operating Environment en versiones anteriores a la 5.0.0.0.5.116, Dell EMC UnityVSA en versiones anteriores a la 5.0.0.0.5.116 y Dell EMC VNXe3200 en versiones anteriores a la 3.1.10.9946299 contienen una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en la p\u00e1gina cas/logout. Un atacante remoto no identificado podr\u00eda potencialmente aprovechar esta vulnerabilidad enga\u00f1ando a un usuario de una aplicaci\u00f3n v\u00edctima para que proporcione c\u00f3digo HTML o JavaScript malicioso a Unisphere, que se devuelve a la v\u00edctima y es ejecutado por el navegador web."}], "id": "CVE-2019-3754", "lastModified": "2019-10-09T23:49:35.413", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2019-09-03T17:15:11.273", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/security/en-us/details/536796/DSA-2019-125-Dell-EMC-Unity-and-VNXe3200-Family-Reflected-Cross-Site-Scripting-Vulnerability"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "security_alert@emc.com", "type": "Secondary"}]}