CVE-2022-29091

Vulnerability

Dell Unity, UnityVSA, and UnityXT operating environment versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting (XSS) vulnerability in the Unisphere GUI [1]. The vulnerability is present in the web interface where insufficient input validation allows injection of malicious HTML or JavaScript. No authentication is required to trigger the vulnerable code path, but user interaction is needed for the attack to succeed.

Exploitation

An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim user, reflects malicious HTML or JavaScript code in the context of the vulnerable web application [1]. The attacker does not need any prior access or credentials. The victim must click the crafted link, possibly delivered via phishing or other social engineering techniques.

Impact

Successful exploitation leads to execution of attacker-controlled HTML or JavaScript in the victim's browser within the Unisphere GUI session [1]. This can result in information disclosure, session theft (e.g., cookie hijacking), or client-side request forgery, potentially allowing the attacker to perform actions on behalf of the authenticated user.

Mitigation

Dell has released the fix in Unity Operating Environment version 5.2.0.0.5.173 [1]. Administrators are advised to upgrade to this version or later. No workarounds are provided; updating the software is the recommended mitigation.