Description

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-19T14:17:34.040Z",
  "pubdate": "2026-08-19T14:17:34.040Z",
  "executiveSummary": "Dell OpenManage Enterprise contains a Server-Side Request Forgery vulnerability affecting versions prior to 4.7.0. This security flaw allows an unauthenticated remote attacker to induce the vulnerable application into executing arbitrary outbound HTTP requests toward internal or external resources.\nThe primary impact of this vulnerability is information exposure, wherein sensitive internal data, metadata, or backend services normally inaccessible from the external network can be targeted and retrieved through the application's request-handling mechanism.\nThe risk implications are significant, as successful exploitation bypasses network perimeter controls and allows unauthorized reconnaissance of internal network segments.\nAttacker capabilities are strictly remote and unauthenticated, meaning no prior access, credentials, or privileged interaction with the management console are required to initiate an exploitation attempt.\nExploitation requirements are limited to network connectivity to the vulnerable Dell OpenManage Enterprise instance and the ability to supply a manipulated input that dictates the target of the server-side request.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and sanitization within the URL-handling or resource-fetching components of Dell OpenManage Enterprise.\nWhen the application processes user-supplied input intended to reference an external resource or update source, it fails to properly restrict or validate the destination URI scheme, host, or IP address.\nThe vulnerable component resides within the core request-dispatching mechanism of Dell OpenManage Enterprise versions prior to 4.7.0.\nNetwork exposure is remote, and authentication requirements are absent, allowing any unauthenticated network-adjacent or internet-facing attacker to reach the vulnerable endpoint.\nNo privilege requirements exist, lowering the barrier to entry for malicious actors.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request directed at the vulnerable Dell OpenManage Enterprise interface, injecting a malicious URI payload into the parameter processed by the backend resource retriever.\nSecond, the application parses the input without adequate validation and initiates an outbound request from the server hosting Dell OpenManage Enterprise to the attacker-specified destination.\nThird, the targeted internal or external service processes the request and returns the response payload back to the Dell OpenManage Enterprise backend.\nFinally, the application improperly handles or reflects the response data back to the attacker, or exposes the retrieved information through error messages, resulting in unauthorized information exposure.\nPost-exploitation impact includes the mapping of internal network topologies, enumeration of internal services bound to localhost or private subnets, and the potential retrieval of sensitive configuration data or credentials accessible via internal endpoints."
}