CVE-2023-43065

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Dell Unity, Unity VSA, and Unity XT versions prior to 5.3. The vulnerability allows a low-privileged authenticated attacker to inject malicious scripts into the web interface.

Exploitation

An attacker with low-privileged authenticated access to Dell Unity can exploit the XSS vulnerability by crafting a malicious payload that executes in the context of the victim's browser. This requires no additional privileges beyond initial authentication.

Impact

Successful exploitation allows the attacker to obtain escalated privileges, potentially gaining administrative control over the Unity system. This can lead to data disclosure, modification, or disruption of services.

Mitigation

Dell has released version 5.3 of Unity, Unity VSA, and Unity XT to address this vulnerability. Users should upgrade to the fixed version as soon as possible. For more details, refer to Dell security advisory DSA-2023-141 [1].