Read the docs
TI-2019-02771 Aliases CVE-2019-3754GHSA-836g-4hmv-f4fc

Cross-site scripting in Dell EMC Unity Operating Environment

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.

Why it matters now

EPSS 0.01109 66th percentileScored 2026-11-07
Fix Fixed Unity Operating Environment (DELL EMC): 5.0.0.0.5.116UnityVSA Operating Environment (DELL EMC): 5.0.0.0.5.116+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dell EMCUnity Operating Environmentbefore 5.0.0.0.5.1165.0.0.0.5.116Patch availableCNA
Dell EMCUnityVSA Operating Environmentbefore 5.0.0.0.5.1165.0.0.0.5.116Patch availableCNA
Dell EMCVNXe3200 Operating Environmentbefore 3.1.10.99462993.1.10.9946299Patch availableCNA
  • Unity Operating Environment VendorDell EMC Affected before 5.0.0.0.5.116 Fixed in 5.0.0.0.5.116 Patch available CNA
  • UnityVSA Operating Environment VendorDell EMC Affected before 5.0.0.0.5.116 Fixed in 5.0.0.0.5.116 Patch available CNA
  • VNXe3200 Operating Environment VendorDell EMC Affected before 3.1.10.9946299 Fixed in 3.1.10.9946299 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*before 5.0.0.0.5.116VulnerableDell
cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:*before 5.0.0.0.5.116VulnerableDell
cpe:2.3:o:dell:emc_vnxe3200_firmware:*:*:*:*:*:*:*:*before 3.1.10.9946299VulnerableDell
cpe:2.3:h:dell:emc_vnxe3200:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:* Versions before 5.0.0.0.5.116 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:* Versions before 5.0.0.0.5.116 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_vnxe3200_firmware:*:*:*:*:*:*:*:* Versions before 3.1.10.9946299 Vulnerable ·Dell
  • cpe:2.3:h:dell:emc_vnxe3200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA Unity Operating Environment (DELL EMC) Fixed in 5.0.0.0.5.116
  • Fix · CNA UnityVSA Operating Environment (DELL EMC) Fixed in 5.0.0.0.5.116
  • Fix · CNA VNXe3200 Operating Environment (DELL EMC) Fixed in 3.1.10.9946299

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3754
  2. 2026-10-03 Alias added: GHSA-836g-4hmv-f4fc

References

Advisory 1

  • TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
  • TI-2018-01141 OS command injection in Dell EMC RecoverPoint CVSS 3.0CRITICAL 9.8
  • TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2017-05620 EMC Networker Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
  • TI-2018-11243 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution… CVSS 3.0CRITICAL 9.8
  • TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences