CVE-2022-33929

Vulnerability

A reflected cross-site scripting vulnerability exists in the EndUserSummary page of Dell Wyse Management Suite versions 3.6.1 and below. An authenticated attacker can inject malicious HTML or JavaScript via crafted input that is reflected back to the victim's browser without proper sanitization. Affected versions: 3.6.1 and earlier.

Exploitation

An attacker must be authenticated to the Wyse Management Suite and craft a malicious link containing the XSS payload. The victim, also authenticated, must click the link. The payload executes in the context of the vulnerable web application, leading to potential session theft or client-side request forgery.

Impact

Successful exploitation allows the attacker to execute arbitrary HTML/JavaScript in the victim's browser, leading to information disclosure, session hijacking, or client-side request forgery. The attacker gains the ability to perform actions on behalf of the victim within the application.

Mitigation

Dell released a security update (DSA-2022-134) addressing this vulnerability [1]. Users should upgrade to Wyse Management Suite version 3.7 or later. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication.