Database/Firmware, BMC & network fabric
Dell OpenManage Enterprise: unauthenticated XSS in the console tampers with information
Impact
The OME web console generates a page without neutralizing input, so an unauthenticated attacker who gets an operator to follow a crafted link runs script in that operator's console session. Dell marks the scope as changed with low confidentiality and integrity impact, which fits stealing or acting within the session of whoever is logged in. The reason this matters on a fleet console rather than an ordinary web app: the session being hijacked typically belongs to someone with authority to push firmware, change boot settings and power-cycle GPU nodes. No availability impact and user interaction is required.
Who can reach it
Anyone who can get a logged-in OME operator to open a crafted URL; no attacker authentication needed, but the victim must interact.
What to do
Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and console restart. Until then, treat links into the management console with suspicion and keep console access off general-purpose browsing sessions. No vendor workaround is published.
References
Related entries
- Intel Ethernet E810 Series and Ethernet 700 Series firmware: Out-of-bounds write in firmware across both the E810 lineCVE-2022-36382 · Intel Ethernet E810 Series and Ethernet 700 Series firmwareMedium
- Intel processors with SGX (shared resource isolation): Improper isolation of shared microarchitectural resources lets aCVE-2022-38090 · Intel processors with SGX (shared resource isolation)Medium
- Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit): The dynamic-counter netlink setter bounded itsCVE-2022-49199 · Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit)Medium
- AMD SEV-SNP firmware, guest teardown / UMC key seed handling: TENANT HANDOFF FAILURECVE-2023-31355 · AMD SEV-SNP firmware, guest teardown / UMC key seed handlingMedium
- AMI MegaRAC SPx (IPMI handler): Arbitrary file upload and download through the BMC's IPMI handlerCVE-2023-34342 · AMI MegaRAC SPx (IPMI handler)Medium
- Intel TDX module: The TDX module is the software that stands between the host/VMM and every confidential VM on the boxCVE-2023-47855 · Intel TDX moduleMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.