Read the docs
TI-2021-04634 Aliases CVE-2021-21549GHSA-xx5f-9pxf-9c8j

Cross-site request forgery in Dell XtremIO

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this vulnerability, leading to a privileged victim application user being tricked into sending state-changing requests to the vulnerable application, causing unintended server operations.

Why it matters now

EPSS 0.00429 37th percentileScored 2026-11-07
Fix Fixed XtremIO (Dell): XMS 6.3.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellXtremIObefore XMS 6.3.3XMS 6.3.3Patch availableCNA
  • XtremIO VendorDell Affected before XMS 6.3.3 Fixed in XMS 6.3.3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:*before 6.3.3-8VulnerableDell
cpe:2.3:h:dell:xtremio_x1:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:xtremio_x2:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:* Versions before 6.3.3-8 Vulnerable ·Dell
  • cpe:2.3:h:dell:xtremio_x1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:xtremio_x2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA XtremIO (Dell) Fixed in XMS 6.3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21549
  2. 2026-10-03 Alias added: GHSA-xx5f-9pxf-9c8j

References

Advisory 1

  • TI-2022-13266 Missing brute-force protection in Dell XtremIO CVSS 3.1CRITICAL 9.8
  • TI-2019-13447 Cross-site scripting in Dell XtremIO CVSS 3.1CRITICAL 9.0
  • TI-2025-21454 Sensitive information in log files in Dell XtremIO CVSS 3.1HIGH 8.8
  • TI-2025-19298 Sensitive information in log files in Dell TechAdvisor CVSS 3.1HIGH 8.8
  • TI-2019-13446 Incorrect permission assignment in Dell XtremIO CVSS 3.1MEDIUM 6.7
  • TI-2019-13445 Sensitive information in log files in Dell XtremIO CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences