CVE-2023-44286

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-14 · updated 2026-06-17
Weakness: CWE-79

Description

Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the injection of malicious HTML or JavaScript code to a victim user's DOM environment in the browser. . Exploitation may lead to information disclosure, session theft, or client-side request forgery.

Affected products

Dell Apex Protection Storage: before 6.2.1.110; from 7.0 before 7.10.1.15 — fixed in 6.2.1.110, 7.10.1.15
EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0: before 6.2.1.110; from 7.0 before 7.12.0.0; from 7.7 before 7.7.5.25; from 7.10 before 7.10.1.15 — fixed in 6.2.1.110, 7.10.1.15, 7.12.0.0, 7.7.5.25
Dell Powerprotect Data Domain: before 6.2.1.110; from 7.0 before 7.12.0.0 — fixed in 6.2.1.110, 7.12.0.0
Dell PowerProtect DD: before 6.2.1.110; from 7.0 before 7.13.0.10; from 7.7 before 7.7.5.25; from 7.10 before 7.10.1.15 — fixed in 6.2.1.110, 7.10.1.15, 7.13.0.10, 7.7.5.25
Dell Powerprotect Data Protection: before 2.7.6 — fixed in 2.7.6

How to fix

Upgrade to a fixed version: Dell Apex Protection Storage 6.2.1.110, 7.10.1.15; EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 6.2.1.110, 7.10.1.15, 7.12.0.0, 7.7.5.25; Dell Powerprotect Data Domain 6.2.1.110, 7.12.0.0; Dell PowerProtect DD 6.2.1.110, 7.10.1.15, 7.13.0.10, 7.7.5.25; Dell Powerprotect Data Protection 2.7.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-44286 or the next vulnerability affects your stack