Technical impact
PowerStore contains a stored cross‑site scripting vulnerability in its Manager interface. A remotely authenticated low‑privileged user can store malicious scripts that are later executed in the browsers of users who view the affected content. This can allow the attacker to run arbitrary code in those browsers, potentially stealing session data or performing other client‑side attacks. The weakness is a classic stored XSS flaw, identified as CWE‑79.
Affected Systems
The vulnerability affects Dell PowerStore systems, specifically the PowerStore Manager component. No specific version information is provided in the advisory, so all deployments of PowerStore Manager should be considered vulnerable until a patch is released.
Risk and Exploitability
The CVSS base score of 5.4 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote authentication with low‑privilege credentials and access to the Manager UI, so the attack surface is limited to users who can log in to the manager. Overall risk remains moderate but not critical.
