CVE-2019-3769

Vulnerability

Dell Wyse Management Suite (WMS) versions prior to 1.4.1 contain a stored cross-site scripting (XSS) vulnerability in the device heartbeat request. A remote authenticated malicious user with low privileges can inject malicious payloads into the heartbeat data. When other users access the submitted data through their browsers, the payload executes in the context of the vulnerable application [1].

Exploitation

An attacker must have a low-privilege authenticated account on the WMS. The attacker crafts a malicious heartbeat request containing JavaScript or HTML code. This request is stored by the server. When a victim user (e.g., an administrator) views the device heartbeat data via the web interface, the stored script executes in their browser, bypassing same-origin policy [1].

Impact

Successful exploitation allows the attacker to execute arbitrary scripts in the victim's browser within the WMS application context. This can lead to theft of session cookies, data exfiltration, or defacement. The CVSS v3 base score is 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating low confidentiality and integrity impact but with scope change [1].

Mitigation

Dell has addressed this vulnerability in WMS version 1.4.1. Users should upgrade to this version or later. No workarounds are documented. The advisory is available in Dell Security Advisory DSA-2019-161 [1].