Detections
Analytics
Dell Wyse Management Suite < 3.7 Multiple Vulnerabilities (DSA-2022-143)
medium Nessus Plugin ID 166752
Language:
Synopsis
Dell Wyse Management Suite installed on the local host is affected by a vulnerability.Description
The version of Dell Wyse Management Suite installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the DSA-2022-143 advisory.- jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the 'of' option of the '.position()' util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the 'of' option is now treated as a CSS selector. A workaround is to not accept the value of the 'of' option from untrusted sources. (CVE-2021-41184)
- Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. (CVE-2022-29096)
- Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application. (CVE-2022-29097)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Dell Wyse Management Suite version 3.7 or later.See Also
Plugin Details
Severity: Medium
ID: 166752
File Name: dell_wyse_management_suite_dsa-2022-143.nasl
Version: 1.4
Type: local
Agent: windows
Family: Windows
Published: 11/1/2022
Updated: 10/6/2023
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2021-41184
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:dell:wyse_management_suite
Required KB Items: installed_sw/Dell Wyse Management Suite
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/31/2022
Vulnerability Publication Date: 5/31/2022