CVE-2021-42080 Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An attacker can execute arbitrary JavaScript in the victim's browser via a crafted URL, potentially stealing cookies or session tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-42080?
CVE-2021-42080 is a high-severity cross-site scripting vulnerability in OSNEXUS QuantaStor, published on 10 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An attacker is able to launch a Reflected XSS attack using a crafted URL.
POC:
Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>
Weakness: CWE-79
Which versions are affected by CVE-2021-42080?
It affects 1 product.
Products include Osnexus Quantastor.
How do I fix CVE-2021-42080?
No fix has been published for CVE-2021-42080 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-42080 being exploited?
There is no known exploitation of CVE-2021-42080 in the wild and no public exploit code.
Other vulnerabilities in OSNEXUS QuantaStor
- CVE-2021-42081 Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355
- CVE-2021-4406 Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others
- CVE-2021-42083 Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
- CVE-2021-42082 Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355
- CVE-2021-42079 SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355
Sources
Also known as GHSA-wf5c-q6vq-584r.