The security issue was discovered by Justin Habben of North Dakota State University in his research paper “ The Dell EMC OpenManage Power Center 5.0, 5.1, 5.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).The security issue was discovered by Justin Habben of North Dakota State University in his research paper “ Dell EMC OpenManage Power Center 5.0 - XSS Vulnerabilities and Exploitation.”
1. Details The Dell EMC OpenManage Power Center is a network management software used to monitor and manage IT infrastructure such as servers, storage, routers and switches. The software is installed on Windows, Linux, and Mac OS X based servers. The latest version of OpenManage Power Center 5.0, 5.1, 5.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious code into the system that can lead to the hijacking of an end-user’s session or the installation of a backdoor. The issue was discovered by Justin Habben of North Dakota State University in his research paper “ Dell EMC OpenManage Power Center 5.0 - XSS Vulnerabilities and Exploitation.”
How the XSS works?
The XSS vulnerability has been identified by Justin Habben of North Dakota State University in his research paper “ Dell EMC OpenManage Power Center 5.0 - XSS Vulnerabilities and Exploitation.” The issue has been confirmed in the latest version of OpenManage Power Center 5.0, 5.1, 5.2, and OP5 8.3.3 which is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious code into the system that can lead to the hijacking of an end-user’s session or the installation of a backdoor.
How Does It Work?
There are three vulnerabilities in OpenManage Power Center that allow an attacker to exploit it. The first vulnerability is called the “Session Management” vulnerability. This vulnerability allows an attacker to inject a malicious script into the system through a web browser and hijack end-users’ session. The second vulnerability is called the “Web Interface Vulnerability,” which can be used in conjunction with the first vulnerability or by itself. This vulnerability allows an attacker to inject a malicious script into the system that can lead to the hijacking of an end-user’s session or the installation of a backdoor. The third vulnerability is called the “Backdoor Vulnerability,” which allows an attacker to inject a malicious script into the system in order to gain access to highly privileged information such as root privileges on remote systems.
How do you trigger the XSS?
An attacker needs to trick a user into visiting the malicious webpage and then trick them into clicking on the injected script. This can be done by posting a link to the malicious page on a legitimate website, including but not limited to Facebook, Twitter, and Pinterest.
An attacker can also embed an iframe within an email or IM message that triggers the XSS when opened.
Timeline
Published on: 11/14/2022 16:15:00 UTC
Last modified on: 11/16/2022 20:58:00 UTC