Cross-site scripting in Dell Unisphere for PowerMax
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users' sessions.
Why it matters now
EPSS 0.00674 52nd percentileScored 2026-11-07
Fix Fixed Unisphere for PowerMax (Dell): 9.1.0.9 and 9.0.2.16
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Unisphere for PowerMax | before 9.1.0.9 and 9.0.2.16 | 9.1.0.9 and 9.0.2.16 | Patch available | CNA |
- Unisphere for PowerMax VendorDell Affected before 9.1.0.9 and 9.0.2.16 Fixed in 9.1.0.9 and 9.0.2.16 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:emc_powermax:5978.221.221:*:*:*:*:*:*:* | 5978.221.221 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_powermax:5978.479.479:*:*:*:*:*:*:* | 5978.479.479 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_unisphere_for_powermax:*:*:*:*:*:*:*:* | before 9.0.2.16; 9.1.0.0 to before 9.1.0.9 | Vulnerable | Dell |
- cpe:2.3:a:dell:emc_powermax:5978.221.221:*:*:*:*:*:*:* Versions 5978.221.221 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_powermax:5978.479.479:*:*:*:*:*:*:* Versions 5978.479.479 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_unisphere_for_powermax:*:*:*:*:*:*:*:* Versions before 9.0.2.16; 9.1.0.0 to before 9.1.0.9 Vulnerable ·Dell
Remediation
- Fix · CNA Unisphere for PowerMax (Dell) Fixed in 9.1.0.9 and 9.0.2.16
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18588
- 2026-10-03 Alias added: GHSA-5qmp-8h68-wq8j
References
Sources
- CVE-2019-18588 · CVE Program
- CVE-2019-18588 · NVD
- FIRST EPSS
- GHSA-5qmp-8h68-wq8j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences