Read the docs
TI-2020-17862 Aliases CVE-2020-35170GHSA-w6hg-rmw9-vhr2

Cross-site scripting in Dell Unisphere for PowerMax

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users’ sessions.

Why it matters now

EPSS 0.00625 50th percentileScored 2026-11-07
Fix Fixed Unisphere for PowerMax (Dell): 9.1.0.24

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellUnisphere for PowerMaxbefore 9.1.0.249.1.0.24Patch availableCNA
  • Unisphere for PowerMax VendorDell Affected before 9.1.0.24 Fixed in 9.1.0.24 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:dell:unisphere:*:*:*:*:*:*:powermax:*before 9.1.0.24; 9.2 to before 9.2.0.6VulnerableDell
cpe:2.3:o:dell:powermax_os:5978.221.221:*:*:*:*:*:*:*5978.221.221VulnerableDell
cpe:2.3:o:dell:powermax_os:5978.479.479:*:*:*:*:*:*:*5978.479.479VulnerableDell
  • cpe:2.3:a:dell:unisphere:*:*:*:*:*:*:powermax:* Versions before 9.1.0.24; 9.2 to before 9.2.0.6 Vulnerable ·Dell
  • cpe:2.3:o:dell:powermax_os:5978.221.221:*:*:*:*:*:*:* Versions 5978.221.221 Vulnerable ·Dell
  • cpe:2.3:o:dell:powermax_os:5978.479.479:*:*:*:*:*:*:* Versions 5978.479.479 Vulnerable ·Dell

Remediation

  • Fix · CNA Unisphere for PowerMax (Dell) Fixed in 9.1.0.24

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35170
  2. 2026-10-03 Alias added: GHSA-w6hg-rmw9-vhr2
  3. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2023-26510 OS command injection in Dell vApp Manager CVSS 3.1HIGH 7.2
  • TI-2021-04616 Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass… CVSS 3.1HIGH 8.1
  • TI-2020-04418 Improper certificate validation in Dell Unisphere for PowerMax, Unisphere for PowerMax… CVSS 3.1HIGH 8.1
  • TI-2023-26512 OS command injection in Dell vApp Manager, CVSS 3.1HIGH 7.2
  • TI-2023-26511 OS command injection in Dell vApp Manager CVSS 3.1HIGH 7.2
  • TI-2023-26509 OS command injection in Dell vApp Manager CVSS 3.1HIGH 7.2
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences