CVE-2013-3589

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-09-24 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the login page in the Administrative Web Interface on Dell iDRAC6 monolithic devices with firmware before 1.96 and iDRAC7 devices with firmware before 1.46.45 allows remote attackers to inject arbitrary web script or HTML via the ErrorMsg parameter.

Affected products

Dell Idrac6 Firmware: through 1.95; 1.0, 1.1, 1.2, 1.3, 1.5, 1.6 (+1)
Dell EMC iDRAC6 (Monolithic): all versions
Dell EMC iDRAC7: all versions
Dell Idrac7 Firmware: through 1.40.40; 1.00.00, 1.06.06, 1.10.10, 1.20.20, 1.23.23, 1.37.35

References

http://www.kb.cert.org/vuls/id/920038
http://www.kb.cert.org/vuls/id/BLUU-997QVW
http://www.kb.cert.org/vuls/id/920038
http://www.kb.cert.org/vuls/id/BLUU-997QVW

Get alerted when CVE-2013-3589 or the next vulnerability affects your stack