CVE-2017-9979
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 2.6%
from disclosure to weapon0 days
Published on NVDAug 28
1st PoCAug 18
exploitation probability
2.6%top 17% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.htmlunverifiedcve_referencewww.exploit-db.com/exploits/42517/unverifiedexploitdbwww.exploit-db.com/exploits/42517unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.