« Volver al listado

CVE-2021-21515

Estado: ModificadaMedia (5.4)—

Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — EMC Sourceone

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21515",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "SourceOne",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "7.2SP10-HF2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-03-01T21:15:13.957",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000183430/dsa-2021-043-dell-emc-sourceone-java-script-xss-stored-vulnerability",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000183430/dsa-2021-043-dell-emc-sourceone-java-script-xss-stored-vulnerability",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server."
    },
    {
      "lang": "es",
      "value": "Dell EMC SourceOne, versiones 7.2SP10 y anteriores, contienen una vulnerabilidad de tipo Cross-Site Scripting almacenado. Un atacante remoto poco privilegiado puede explotar esta vulnerabilidad para secuestrar sesiones de usuario o engañar a un usuario de la aplicación víctima para que, sin saberlo, envíe peticiones arbitrarias al servidor"
    }
  ],
  "lastModified": "2026-06-17T03:35:42.517",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9E8FCF9-784C-455D-8DE6-94DD68592B4F",
              "versionEndExcluding": "7.2"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78352AD1-92DC-43D8-9200-6125DF04A51C"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4091F5F1-A616-46C9-871A-E1EB0E7F6C9B"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4863595-10CD-4F4A-A9F4-BB48E32C90CB"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B35C81BC-3CC2-4A6A-8C90-64D7A9A756E7"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA0CBB46-3A9A-4C28-AB65-A4F8533C909B"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E97B769-1BC9-416F-BAE5-DBF46B430364"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1ED1553F-CF49-40B1-B4DB-76ACFD469FC1"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE7D3E3D-3CEA-44C1-A06C-14739116C1AE"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10ABB9CB-5C5F-4238-BB41-F1E491C8BD89"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_sourceone:7.2:sp9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "330A1037-01CA-45B1-BD24-B07AABF14AC4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}