{"id":"CVE-2019-18578","published":"2020-03-13T20:30:21Z","modified":"2024-09-16T23:41:09Z","title":"Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability","vendor":"Dell","product":"XtremIO","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dell","product":"XtremIO","versions":[">= unspecified, < 6.3.0"]}],"description":{"text":"Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through their browsers, the malicious code may be executed by the web browser in the context of the vulnerable web application.","provenance":"source","from":"CVE.org"},"summary":{"text":"A stored cross-site scripting flaw exists in Dell EMC XtremIO XMS, in versions prior to 6.3.0, where the web application fails to neutralise input stored in its fields. An attacker with low-privileged remote access can plant malicious HTML or JavaScript that executes in the browser of any user who views the injected page, which requires that user to interact with it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:43Z"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01127,"percentile":0.66209,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.dell.com/support/security/en-us/details/539703/DSA-2019-172-Dell-EMC-XtremIO-Security-Update-for-Multiple-Vulnerabilities","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"high"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-8325","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8325","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"source"},{"stage":"primary","techniques":["T1059.007"],"provenance":"source"},{"stage":"secondary","techniques":["T1185"],"provenance":"source"}],"timeline":[{"date":"2020-03-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-18578","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":13.24,"detail":"percentile 0.6621"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}