cnvd - cnvd-2025-11987

cnvd-2025-11987

Vulnerability from cnvd

Title: Dell Storage Manager XML外部实体引用限制不当漏洞

Description:

Dell Storage Manager是一款用于管理和监控戴尔存储系统的软件，提供集中管理、性能监控和故障排除等功能，支持多种戴尔存储产品。

Dell Storage Manager存在XML外部实体引用限制不当漏洞，该漏洞源于处理XML数据时，未能正确限制外部实体引用。攻击者可利用该漏洞获取敏感信息或篡改数据。

Severity: 高

Patch Name: Dell Storage Manager XML外部实体引用限制不当漏洞的补丁

Patch Description:

Dell Storage Manager是一款用于管理和监控戴尔存储系统的软件，提供集中管理、性能监控和故障排除等功能，支持多种戴尔存储产品。

Dell Storage Manager存在XML外部实体引用限制不当漏洞，该漏洞源于处理XML数据时，未能正确限制外部实体引用。攻击者可利用该漏洞获取敏感信息或篡改数据。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://www.dell.com/support/product-details/en-us/product/storage-scv3000/drivers

Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-22478

Impacted products

Name
DELL Dell Storage Manager 20.1.20

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-22478",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-22478"
    }
  },
  "description": "Dell Storage Manager\u662f\u4e00\u6b3e\u7528\u4e8e\u7ba1\u7406\u548c\u76d1\u63a7\u6234\u5c14\u5b58\u50a8\u7cfb\u7edf\u7684\u8f6f\u4ef6\uff0c\u63d0\u4f9b\u96c6\u4e2d\u7ba1\u7406\u3001\u6027\u80fd\u76d1\u63a7\u548c\u6545\u969c\u6392\u9664\u7b49\u529f\u80fd\uff0c\u652f\u6301\u591a\u79cd\u6234\u5c14\u5b58\u50a8\u4ea7\u54c1\u3002\n\nDell Storage Manager\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u9650\u5236\u4e0d\u5f53\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5904\u7406XML\u6570\u636e\u65f6\uff0c\u672a\u80fd\u6b63\u786e\u9650\u5236\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u6216\u7be1\u6539\u6570\u636e\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://www.dell.com/support/product-details/en-us/product/storage-scv3000/drivers",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-11987",
  "openTime": "2025-06-09",
  "patchDescription": "Dell Storage Manager\u662f\u4e00\u6b3e\u7528\u4e8e\u7ba1\u7406\u548c\u76d1\u63a7\u6234\u5c14\u5b58\u50a8\u7cfb\u7edf\u7684\u8f6f\u4ef6\uff0c\u63d0\u4f9b\u96c6\u4e2d\u7ba1\u7406\u3001\u6027\u80fd\u76d1\u63a7\u548c\u6545\u969c\u6392\u9664\u7b49\u529f\u80fd\uff0c\u652f\u6301\u591a\u79cd\u6234\u5c14\u5b58\u50a8\u4ea7\u54c1\u3002\r\n\r\nDell Storage Manager\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u9650\u5236\u4e0d\u5f53\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5904\u7406XML\u6570\u636e\u65f6\uff0c\u672a\u80fd\u6b63\u786e\u9650\u5236\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u6216\u7be1\u6539\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dell Storage Manager XML\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u9650\u5236\u4e0d\u5f53\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "DELL Dell Storage Manager 20.1.20"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-22478",
  "serverity": "\u9ad8",
  "submitTime": "2025-05-09",
  "title": "Dell Storage Manager XML\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u9650\u5236\u4e0d\u5f53\u6f0f\u6d1e"
}

CVE-2025-22478 (GCVE-0-2025-22478)

Vulnerability from cvelistv5

Published

2025-05-06 15:55

Modified

2025-05-08 03:56

Severity ?

8.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Summary

Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.

References

▼	URL	Tags
	https://www.dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities	vendor-advisory

Impacted products

	Vendor	Product	Version
	Dell	Dell Storage Center - Dell Storage Manager	Version: N/A ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-08T03:56:09.072Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Dell Storage Center - Dell Storage Manager",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "2020 R1.21",
              "status": "affected",
              "version": "N/A",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dell would like to thank sradulea for reporting this issue."
        }
      ],
      "datePublic": "2025-05-05T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.\u003cbr\u003e"
            }
          ],
          "value": "Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-06T15:55:03.918Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000317318/dsa-2025-191-security-update-for-storage-center-dell-storage-manager-vulnerabilities"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2025-22478",
    "datePublished": "2025-05-06T15:55:03.918Z",
    "dateReserved": "2025-01-07T06:04:12.135Z",
    "dateUpdated": "2025-05-08T03:56:09.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted