Unscored severity · published Sep 24, 2013
CVE-2013-3589
Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Idrac6 Firmware · Dell
through 1.95; 1.0; 1.1; 1.2; 1.3; 1.5; +2 more · source: NVD
IM
Idrac6 Monolithic · Dell
All versions, or not specified · source: NVD
ID
Idrac7 · Dell
All versions, or not specified · source: NVD
IF
Idrac7 Firmware · Dell
through 1.40.40; 1.00.00; 1.06.06; 1.10.10; 1.20.20; 1.23.23; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3589
US Government Resource
http://www.kb.cert.org/vuls/id/920038
US Government Resource
http://www.kb.cert.org/vuls/id/BLUU-997QVW
More from Idrac6 Firmware
9.8
CVE-2019-3705
Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a…
7.5
CVE-2018-1243
Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability
–
CVE-2013-4785
The web interface on the Dell iDRAC6 with firmware before 1.95 allows remote attackers to modify the CLP interface for arbitrary users and possibly have other impact via a request…