← back
CVE-2021-42080

Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355

CVSS 7.4 HIGHEPSS 0.6%CWE-79
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.4EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
10 Jul 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
OSNEXUS · QuantaStor

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://csirt.divd.nl/CVE-2021-42080https://csirt.divd.nl/DIVD-2021-00020/https://www.divd.nl/DIVD-2021-00020https://www.osnexus.com/products/software-defined-storagehttps://www.wbsec.nl/osnexus