Cross-site scripting in Dell Integrated Data Protection Appliance
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.
Why it matters now
EPSS 0.00778 56th percentileScored 2026-11-07
Fix Fixed Integrated Data Protection Appliance (Dell): 2.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Integrated Data Protection Appliance | before 2.3 | 2.3 | Patch available | CNA |
- Integrated Data Protection Appliance VendorDell Affected before 2.3 Fixed in 2.3 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* | 2.1 | Vulnerable | Dell |
| cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Dell |
| cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
| cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Dell |
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Dell
- cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
- cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
- cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Remediation
- Fix · CNA Integrated Data Protection Appliance (Dell) Fixed in 2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3747
- 2026-10-03 Alias added: GHSA-94wc-5cm9-3ffq
References
More Dell Emc Integrated Data Protection Appliance Firmware vulnerabilities
- TI-2020-04393 Deserialization of untrusted data in Dell Avamar Virtual Edition CVSS 3.1CRITICAL 9.8
- TI-2019-02764 Missing brute-force protection in Dell Integrated Data Protection Appliance CVSS 3.1HIGH 8.8
- TI-2019-13451 Code injection in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
- TI-2019-13450 Missing authorization in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
- TI-2019-02755 Broken or risky cryptographic algorithm in Dell Integrated Data Protection Appliance CVSS 3.1HIGH 7.2
Sources
- CVE-2019-3747 · CVE Program
- CVE-2019-3747 · NVD
- FIRST EPSS
- GHSA-94wc-5cm9-3ffq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences