CVE-2021-21542

Description

Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.

Weakness classification

• security_alert@emc.com: CWE-79
• nvd@nist.gov: CWE-79

Primary references

• security_alert@emc.com — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory