TI-2021-04606 Aliases CVE-2021-21515 GHSA-756r-754x-rvfh

Cross-site scripting in Dell SourceOne

MEDIUM 40CWE-79Published 2021-03-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server.

Why it matters now

EPSS 0.00846 58th percentileScored 2026-11-07

Fix Fixed SourceOne (Dell): 7.2SP10-HF2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	SourceOne	before 7.2SP10-HF2	7.2SP10-HF2	Patch available	CNA

SourceOne VendorDell Affected before 7.2SP10-HF2 Fixed in 7.2SP10-HF2 Patch available CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:emc_sourceone::::::::	before 7.2	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:-::::::	7.2	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp1::::::	7.2 sp1	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp2::::::	7.2 sp2	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp3::::::	7.2 sp3	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp4::::::	7.2 sp4	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp5::::::	7.2 sp5	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp6::::::	7.2 sp6	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp7::::::	7.2 sp7	Vulnerable	Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp8::::::	7.2 sp8	Vulnerable	Dell

cpe:2.3:a:dell:emc_sourceone:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp1:*:*:*:*:*:* Versions 7.2 sp1 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp2:*:*:*:*:*:* Versions 7.2 sp2 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp3:*:*:*:*:*:* Versions 7.2 sp3 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp4:*:*:*:*:*:* Versions 7.2 sp4 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp5:*:*:*:*:*:* Versions 7.2 sp5 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp6:*:*:*:*:*:* Versions 7.2 sp6 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp7:*:*:*:*:*:* Versions 7.2 sp7 Vulnerable ·Dell
cpe:2.3:a:dell:emc_sourceone:7.2:sp8:*:*:*:*:*:* Versions 7.2 sp8 Vulnerable ·Dell

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:emc_sourceone:7.2:sp9::::::	7.2 sp9	Vulnerable	Dell

cpe:2.3:a:dell:emc_sourceone:7.2:sp9:*:*:*:*:*:* Versions 7.2 sp9 Vulnerable ·Dell

Remediation

Fix · CNA SourceOne (Dell) Fixed in 7.2SP10-HF2

Timeline

2026-10-02 Threatist record created from CVE-2021-21515
2026-10-03 Alias added: GHSA-756r-754x-rvfh

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000183430/dsa-2021-043-dell-emc-sourceone-java-script-xss-stored-vulnerability

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences