« Volver al listado

CVE-2025-23379

Estado: AnalizadaMedia (5.2)—

Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dell — Storage Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23379",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23379",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-06T15:45:08.839133Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Dell Storage Center - Dell Storage Manager",
          "versions": [
            {
              "status": "affected",
              "version": "N/A",
              "lessThan": "2020 R1.21",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-06T16:15:27.557",
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection."
    },
    {
      "lang": "es",
      "value": "Dell Storage Center - Dell Storage Manager, versión 21.0.20, contiene una vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web («Cross-site Scripting»). Un atacante no autenticado con acceso a la red adyacente podría explotar esta vulnerabilidad, lo que provocaría la inyección de scripts."
    }
  ],
  "lastModified": "2026-06-17T08:53:54.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:storage_manager:16.3.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B35D3F3-363D-42AF-A582-FFA03154B20A"
            },
            {
              "criteria": "cpe:2.3:a:dell:storage_manager:2016:r2.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43A8A705-CD7C-4AE8-9175-923BCE7BB6F1"
            },
            {
              "criteria": "cpe:2.3:a:dell:storage_manager:2020:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "567442CC-381B-43A1-ADE9-AE00075021D4"
            },
            {
              "criteria": "cpe:2.3:a:dell:storage_manager:2020:r1.10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B978EFB1-877F-4091-A401-F1861229E033"
            },
            {
              "criteria": "cpe:2.3:a:dell:storage_manager:2020:r1.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "263E78BD-D8C0-480F-9EED-D5496708CFCD"
            },
            {
              "criteria": "cpe:2.3:a:dell:storage_manager:2020:r1.20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1055DB85-9105-44E5-9CEB-509C7F7041FE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}