CVE-2025-23377

Published: Apr 28, 2025Modified: Jun 17, 2026

3.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Exploitability: 0.8 / Impact: 2.5

Source: NVD

Description

Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to inject arbitrary web script or html in reporting outputs.

Affected (2)

Products: Dell: Powerprotect Data Manager

1 product

Powerprotect Data Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Dell Powerprotect Data Manager	Version 19.17
Dell Powerprotect Data Manager	Version 19.18

Related CWEs

Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (1)

https://www.dell.com/support/kbdoc/en-us/000311083/dsa-2025-062-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities

Source: security_alert@emc.com

Vendor Advisory

Timeline

No history available yet.