CVE-2013-3589

Published: Sep 24, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.

Affected (17)

Products: Dell: Idrac6 Firmware, Idrac6 Monolithic, Idrac7 Firmware, Idrac7

4 products

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Dell Idrac6 Firmware	Up to 1.95
Dell Idrac6 Firmware	Version 1.0
Dell Idrac6 Firmware	Version 1.1
Dell Idrac6 Firmware	Version 1.2
Dell Idrac6 Firmware	Version 1.3
Dell Idrac6 Firmware	Version 1.5
Dell Idrac6 Firmware	Version 1.6
Dell Idrac6 Firmware	Version 1.8
Dell Idrac6 Monolithic	All versions

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Dell Idrac7 Firmware	Up to 1.40.40
Dell Idrac7 Firmware	Version 1.00.00
Dell Idrac7 Firmware	Version 1.06.06
Dell Idrac7 Firmware	Version 1.10.10
Dell Idrac7 Firmware	Version 1.20.20
Dell Idrac7 Firmware	Version 1.23.23
Dell Idrac7 Firmware	Version 1.37.35
Dell Idrac7	All versions