Read the docs
TI-2022-14939 Aliases CVE-2022-33935GHSA-jv78-qfm7-p5qh

Cross-site scripting in Dell Data Protection Advisor

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Why it matters now

EPSS 0.00438 38th percentileScored 2026-11-07
Fix Fixed Data Protection Advisor (Dell): 19.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellData Protection Advisorbefore 19.519.5Patch availableCNA
  • Data Protection Advisor VendorDell Affected before 19.5 Fixed in 19.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_data_protection_advisor:*:*:*:*:*:*:*:*up to 19.6VulnerableDell
  • cpe:2.3:a:dell:emc_data_protection_advisor:*:*:*:*:*:*:*:* Versions up to 19.6 Vulnerable ·Dell

Remediation

  • Fix · CNA Data Protection Advisor (Dell) Fixed in 19.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-33935
  2. 2026-10-03 Alias added: GHSA-jv78-qfm7-p5qh

References

Patch 1

  • TI-2020-04404 OS command injection in Dell Data Protection Advisor CVSS 3.1HIGH 8.8
  • TI-2019-13451 Code injection in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
  • TI-2018-07834 XML external entity injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.1
  • TI-2019-13450 Missing authorization in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
  • TI-2016-06764 Path traversal in EMC Data Protection Advisor EMC Data Protection Advisor 6.1.x, EMC Data… CVSS 3.1HIGH 7.5
  • TI-2020-04403 Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences