{"id":"CVE-2021-21541","state":"PUBLISHED","title":"Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability ","description":"Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.","publishedAt":"2021-04-30T20:55:19.672Z","updatedAt":"2024-09-16T17:38:25.537Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"dell"},"assigner":"dell","products":["Dell Integrated Dell Remote Access Controller (iDRAC)"],"affected":[{"vendor":"Dell","product":"Integrated Dell Remote Access Controller (iDRAC)","versions":[{"version":"unspecified","status":"affected","lessThan":"4.40.00.00","versionType":"custom"}]}],"references":["https://www.dell.com/support/kbdoc/000185293"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:47:59.168Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/21xxx/CVE-2021-21541.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-21541","state":"PUBLISHED","datePublished":"2021-04-30T20:55:19.672Z","dateUpdated":"2024-09-16T17:38:25.537Z","assignerShortName":"dell","assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","dateReserved":"2021-01-04T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application."}],"affected":[{"vendor":"Dell","product":"Integrated Dell Remote Access Controller (iDRAC)","versions":[{"version":"unspecified","status":"affected","lessThan":"4.40.00.00","versionType":"custom"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/000185293","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"dell","dateUpdated":"2021-04-30T20:55:19.000Z","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe"},"datePublic":"2021-04-14T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@dell.com","DATE_PUBLIC":"2021-04-14","ID":"CVE-2021-21541","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Integrated Dell Remote Access Controller (iDRAC)","version":{"version_data":[{"version_affected":"<","version_value":"4.40.00.00"}]}}]},"vendor_name":"Dell"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application."}]},"impact":{"cvss":{"baseScore":6.1,"baseSeverity":"Medium","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]},"references":{"reference_data":[{"name":"https://www.dell.com/support/kbdoc/000185293","refsource":"MISC","url":"https://www.dell.com/support/kbdoc/000185293"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.dell.com/support/kbdoc/000185293","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T18:16:22.955Z"}}]}}}