Dell Wyse Management Suite < 3.7 Multiple Vulnerabilities (DSA-2022-143)

medium Nessus Plugin ID 166752


Dell Wyse Management Suite installed on the local host is affected by a vulnerability.


The version of Dell Wyse Management Suite installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the DSA-2022-143 advisory.

- jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the 'of' option of the '.position()' util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the 'of' option is now treated as a CSS selector. A workaround is to not accept the value of the 'of' option from untrusted sources. (CVE-2021-41184)

- Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. (CVE-2022-29096)

- Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application. (CVE-2022-29097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Upgrade to Dell Wyse Management Suite version 3.7 or later.

See Also

Plugin Details

Severity: Medium

ID: 166752

File Name: dell_wyse_management_suite_dsa-2022-143.nasl

Version: 1.3

Type: local

Agent: windows

Family: Windows

Published: 11/1/2022

Updated: 11/2/2022

Supported Sensors: Nessus Agent

Risk Information


Risk Factor: Medium

Score: 4.6


Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2021-41184


Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:dell:wyse_management_suite

Required KB Items: installed_sw/Dell Wyse Management Suite

Exploit Ease: No known exploits are available

Patch Publication Date: 5/31/2022

Vulnerability Publication Date: 5/31/2022

Reference Information

CVE: CVE-2021-41184, CVE-2022-29096, CVE-2022-29097