CVE:CVE-2013-3589
CNNVD:CNNVD-201309-419
Dell Integrated Remote Access Controller（iDRAC）6是美国戴尔（Dell）公司的一套包含硬件和软件的系统管理解决方案。该方案为Dell PowerEdge系统提供远程管理、崩溃系统恢复和电源控制等功能。
使用1.95及之前的版本固件的Dell iDRAC6单片机设备和使用1.40.40及之前的版本固件的iDRAC7设备上的Administrative Web Interface中的登录页面中存在跨站脚本漏洞。远程攻击者可借助‘ErrorMsg’参数利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade dell idrac6_firmware to a higher version than 1.95,1.0,1.1,1.2,1.3,1.5,1.6,1.8,and avoid the version (,1.95],1.0,1.1,1.2,1.3,1.5,1.6,1.8; Upgrade dell idrac6_monolithic to a higher version than -; Upgrade dell idrac7_firmware to a higher version than 1.40.40,1.00.00,1.06.06,1.10.10,1.20.20,1.23.23,1.37.35,and avoid the version (,1.40.40],1.00.00,1.06.06,1.10.10,1.20.20,1.23.23,1.37.35; Upgrade dell idrac7 to a higher version than -