EUVD-2025-209922
GHSA-883q-9j5h-3x3g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.
AnalysisAI
Open redirect vulnerability in Dell PowerFlex Manager 4.6.2 and prior enables unauthenticated remote attackers to craft malicious application URLs that silently redirect targeted users to arbitrary attacker-controlled web destinations. Exploitation requires user interaction (CVSS UI:R) - a victim must follow a specially crafted link - but no authentication or special privileges are needed on the attacker's side. The primary risk is phishing: because the initial URL appears to point at a legitimate Dell infrastructure management portal, users are more likely to trust and follow it, making credential theft or sensitive data disclosure against PowerFlex administrators a realistic outcome. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site / Open Redirect) describes a failure to validate or sanitize attacker-supplied redirect destination parameters before issuing an HTTP redirect response. The CVSS Changed Scope (S:C) component accurately reflects the nature of this class of flaw: while the vulnerable code resides within the PowerFlex Manager web application, the impact extends to the victim's browser session and any site the attacker chooses to target. The attack vector is Network (AV:N) with Low complexity (AC:L), meaning no special network positioning or precondition is required. Dell PowerFlex Manager is a centralized management platform for Dell PowerFlex hyper-converged infrastructure, available in both Appliance and Rack deployment form factors - both are confirmed affected per CPE strings cpe:2.3:a:dell:powerflex_manager_(appliance):*:*:*:*:*:*:*:* and cpe:2.3:a:dell:powerflex_manager_(rack):*:*:*:*:*:*:*:*. The affected parameter is part of the publicly reachable web interface, requiring no authenticated session to construct a redirect chain.
RemediationAI
Apply the security updates published by Dell for the relevant deployment form factor: DSA-2025-434 for PowerFlex Manager Appliance (https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities) and DSA-2025-435 for PowerFlex Manager Rack (https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities). No exact patched version number is specified in available intelligence - consult the linked advisories directly to confirm the minimum safe release. As compensating controls prior to patching, restrict access to the PowerFlex Manager web interface to trusted internal networks or VPN-only access, reducing exposure of the redirect endpoint to external attackers. Additionally, deploy email filtering and user awareness guidance specifically targeting PowerFlex administrators, cautioning against following PowerFlex Manager URLs received via unsolicited email or messaging. Web proxy policies that flag or block redirects from the PowerFlex Manager domain to untrusted external domains can provide a defensive layer, though this may require custom policy rules and could interfere with legitimate external redirect flows if any exist.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today