A vulnerability classified as problematic has been found in Dell EMC IsilonSD Management Server 1.1.0. This affects an unknown functionality of the component OVA File Upload. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.

The bug was discovered 04/04/2019. The weakness was released 04/08/2019 as DSA-2019-031: Dell EMC IsilonSD Management Server Cross-Site Scripting (XSS) Vulnerabilities as confirmed mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The public release was coordinated with Dell EMC. This vulnerability is uniquely identified as CVE-2019-3708 since 01/03/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 1.1.1 eliminates this vulnerability. The upgrade is hosted for download at download.emc.com.

Entry connected to this vulnerability is available at VDB-133282. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Dell EMC

Name

• IsilonSD Management Server

Version

• 1.1.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion