XSS Vulnerability in OSNEXUS QuantaStor Virtual Appliance
CVE-2017-9979

6.1MEDIUM

Key Information:

Vendor

Osnexus

Status
Quantastor
Vendor
CVE Published:
28 August 2017

What is CVE-2017-9979?

A Cross-Site Scripting (XSS) vulnerability exists in OSNEXUS QuantaStor v4 virtual appliance prior to version 4.3.1. This issue arises when a non-existent REST call is invoked, resulting in an error that includes the invalid method used. The response generated is not sanitized, enabling an attacker to exploit this flaw by embedding arbitrary HTML or JavaScript code in a parameter. This could lead to unauthorized actions executed on behalf of users or data exposure, highlighting the importance of implementing secure coding practices and proper input validation.

References

http://www.vvvsecurity.com/advisories/vvvsecurity-advisor...
x_refsource_MISC
https://www.exploit-db.com/exploits/42517/
exploitx_refsource_EXPLOIT-DB
http://seclists.org/fulldisclosure/2017/Aug/23
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.