CVE-2020-29497

Vulnerability

Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated user with low privileges can store malicious HTML or JavaScript code in the device tag field. When other users access the submitted data through their browsers, the code executes in the context of the vulnerable application. [1]

Exploitation

An attacker must be authenticated with low privileges. The attacker crafts malicious HTML/JavaScript and stores it under a device tag. When a victim user (e.g., an administrator) views the device details, the injected script executes in the victim's browser. No additional user interaction is required beyond normal browsing.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, data theft, or defacement of the application interface. The CVSS v3.1 base score is 5.4 (Medium). [1]

Mitigation

Dell released version 3.1 to address this vulnerability. Users should upgrade to Wyse Management Suite 3.1 or later. No official workarounds are documented. [1]