DSA-2025-191: Security Update for Storage Center - Dell Storage Manager Vulnerabilities
Résumé: Storage Center - Dell Storage Manager remediation is available for DSM that could be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
High
Détails
| Third-party Component | CVEs | More Information |
| OpenSSH | CVE-2023-48795 | https://nvd.nist.gov/vuln/search |
| jszip | CVE-2022-48285, CVE-2021-23413 | https://nvd.nist.gov/vuln/search |
| JQuery | CVE-2020-11022, CVE-2020-11023, CVE-2015-9251 | https://nvd.nist.gov/vuln/search |
| AngularJS | CVE-2020-7676 | https://nvd.nist.gov/vuln/search |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2025-22479 | Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. | 3.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| CVE-2025-22477 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges. | 8.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| CVE-2025-22478 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering. | 8.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CVE-2025-22476 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution. | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVE-2025-23379 | Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. | 3.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2025-22479 | Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. | 3.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
| CVE-2025-22477 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges. | 8.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| CVE-2025-22478 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering. | 8.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CVE-2025-22476 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution. | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CVE-2025-23379 | Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. | 3.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
Produits concernés et mesure corrective
| Product | Software/Firmware | Affected Versions | Remediated Versions | Link |
| Dell Storage Manager | DSM | Versions prior to 2020 R1.21 | Version 2020 R1.21 or later | https://www.dell.com/support/product-details/product/storage-scv3000/drivers |
| Product | Software/Firmware | Affected Versions | Remediated Versions | Link |
| Dell Storage Manager | DSM | Versions prior to 2020 R1.21 | Version 2020 R1.21 or later | https://www.dell.com/support/product-details/product/storage-scv3000/drivers |
Solutions de contournement et mesures d’atténuation
| CVE ID | Workaround and Mitigation |
| CVE-2023-48795 | Remove vulnerable ChaCha20-Poly1305 cipher from SSH configuration |
Historique des révisions
| Revision | Date | Description |
| 1.0 | 2025-05-05 | Initial Release |
| 2.0 | 2025-05-06 | Adding acknowledgements |
| 3.0 | 2025-05-06 | Corrected minor spelling mistakes. |
| 4.0 | 2026-02-25 | Updating the category section to add Compellent arrays |
Remerciements
CVE-2025-23379, CVE-2025-22479: Dell would like to thank redfr0g for reporting this issue.
CVE-2025-22477, CVE-2025-22478: Dell would like to thank sradulea for reporting this issue.
CVE-2025-22476: Dell would like to thank sradulea and xiaohei from Ubisectech Sirius Team for reporting this issue.
Informations connexes
Mention légale
Produits concernés
FS Series, SC Series, Dell Compellent FS8600, Dell Compellent SC200, Dell Compellent SC220, Dell Compellent SC280, Dell Compellent SC4020, Dell Compellent Series 40, Dell Storage ManagerPropriétés de l’article
Numéro d’article: 000317318
Type d’article: Dell Security Advisory
Dernière modification: 25 Feb 2026
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.