Read the docs
TI-2019-13447 Aliases CVE-2019-18578GHSA-r62g-pxcp-5wp5

Cross-site scripting in Dell XtremIO

Priority MEDIUM 41CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through their browsers, the malicious code may be executed by the web browser in the context of the vulnerable web application.

Why it matters now

EPSS 0.01127 66th percentileScored 2026-11-07
Fix Fixed XtremIO (Dell): 6.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellXtremIObefore 6.3.06.3.0Patch availableCNA
  • XtremIO VendorDell Affected before 6.3.0 Fixed in 6.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:*before 6.3.0VulnerableDell
  • cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:* Versions before 6.3.0 Vulnerable ·Dell

Remediation

  • Fix · CNA XtremIO (Dell) Fixed in 6.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell XtremIO 6.3.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-13446 Incorrect permission assignment in Dell XtremIOPriority LOW 30
    • TI-2019-13445 Sensitive information in log files in Dell XtremIOPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18578
  2. 2026-10-03 Alias added: GHSA-r62g-pxcp-5wp5

References

Advisory 1

  • TI-2022-13266 Missing brute-force protection in Dell XtremIO CVSS 3.1CRITICAL 9.8
  • TI-2025-21454 Sensitive information in log files in Dell XtremIO CVSS 3.1HIGH 8.8
  • TI-2025-19298 Sensitive information in log files in Dell TechAdvisor CVSS 3.1HIGH 8.8
  • TI-2021-04634 Cross-site request forgery in Dell XtremIO CVSS 3.1HIGH 8.8
  • TI-2019-13446 Incorrect permission assignment in Dell XtremIO CVSS 3.1MEDIUM 6.7
  • TI-2019-13445 Sensitive information in log files in Dell XtremIO CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences