Description

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-19T15:17:10.757Z",
  "pubdate": "2026-08-19T15:17:10.757Z",
  "executiveSummary": "An Improper Neutralization of Input During Web Page Generation vulnerability, commonly known as Cross-site Scripting (XSS), exists in Dell OpenManage Enterprise in versions prior to 4.7.0. This security flaw allows an authenticated, low-privileged attacker with remote access capabilities to inject malicious client-side scripts into web pages generated by the vulnerable application. When targeted users access the compromised web interface, the injected scripts execute within the context of their session. The primary risk implication of this vulnerability is information exposure, potentially enabling unauthorized access to sensitive data or session tokens depending on the privileges of the interacting user and the application's session handling implementation. Successful exploitation requires remote network access to the application's web interface and valid low-privileged credentials to interact with the input vectors susceptible to improper sanitization. The vulnerability highlights a failure in output encoding or input validation routines within the web application component of Dell OpenManage Enterprise. Organizations utilizing affected versions face heightened exposure to client-side attacks, necessitating prompt remediation to protect administrative interfaces and enterprise infrastructure management systems.",
  "technicalDetails": "The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') flaw residing within the web application component of Dell OpenManage Enterprise versions prior to 4.7.0. The root cause stems from the application's failure to adequately sanitize, validate, or encode user-supplied input before reflecting it back within dynamically generated web pages. This architectural weakness permits malicious actors to supply crafted payloads containing executable JavaScript or HTML tags through vulnerable HTTP request parameters or input fields.\nExploitation of this vulnerability requires network access to the Dell OpenManage Enterprise web interface and authentication with low privileges. An attacker initiates the attack flow by crafting a malicious input sequence containing arbitrary JavaScript payloads designed to execute within the Document Object Model (DOM) of the victim's browser. Upon submitting or injecting this payload into the vulnerable component, the application stores or reflects the input without proper context-aware output encoding.\nWhen a targeted user navigates to the affected page, the application serves the unescaped payload within the Hypertext Transfer Protocol (HTTP) response. The victim's web browser parses the response and executes the embedded script in the security context of the user's active session. Because the application lacks robust input neutralization, the payload operates with the privileges of the victim user session, allowing the attacker to bypass standard web application boundaries.\nThe post-exploitation impact centers primarily on information exposure. An executing malicious script can access Document cookies, session tokens, local storage, and sensitive data rendered within the DOM of the Dell OpenManage Enterprise interface. Depending on the specific execution flow and victim privileges, the attacker may harvest sensitive management data or perform unauthorized actions on behalf of the interacting user, compromising the confidentiality and integrity of the enterprise management platform."
}