CVE-2025-22478

Published: May 6, 2025Modified: May 13, 2025

8.1

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.

Affected (6)

Products: Dell: Storage Manager

Dell

1 product

Storage Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Dell Storage Manager	Version 16.3.20
Dell Storage Manager	Version 2016 r2.1
Dell Storage Manager	Version 2020 r1.10
Dell Storage Manager	Version 2020 r1.20
Dell Storage Manager	Version 2020 r1.2
Dell Storage Manager	Version 2020 r1

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

https://www.dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities

Source: security_alert@emc.com

Vendor Advisory

Timeline

No history available yet.