CVE-2024-28973

CVE-2024-28973 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Dell PowerProtect DD versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, and LTS 7.7.5.40, including various DD series appliances. This medium-severity vulnerability (CVSS 4.8) allows a remote, high-privileged attacker to inject malicious HTML or JavaScript into the application's data store. When a high-privileged victim user accesses this data, the malicious code executes in their browser, potentially leading to information disclosure, session theft, or client-side request forgery. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.