Dell OpenManage Enterprise contains a cross‑site scripting vulnerability that allows a low privileged attacker who can reach the web interface to inject script into a generated page. If the attacker succeeds the injected script could read sensitive data from the victim’s session or exfiltrate information, leading to unintended information exposure. The flaw is a classic Improper Neutralization of Input during Web Page Generation weakness, which is a type of input validation problem.

Dell OpenManage Enterprise versions prior to 4.7.0 are affected. Any system installed with those versions and exposed to remote access is at risk.

The CVSS score of 4.6 places the vulnerability in the low range. No EPSS score is published, so the likelihood of occurrence is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that a remote attacker with low privileges who can access the web interface could exploit the flaw to execute the injected script and read confidential data. Proper authorization checks alone do not mitigate the issue, so a patch or other countermeasure is required.