CVE-2021-42080

概要

参考情報

• csirt.divd.nl/CVE-2021-42080 · Third Party Advisory
• csirt.divd.nl/DIVD-2021-00020
• osnexus.com/products/software-defined-storage · Product
• wbsec.nl/osnexus · Third Party Advisory
• divd.nl/DIVD-2021-00020

quantastor のその他の脆弱性

• CVE-2021-4406高 7.2An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS…
• CVE-2021-42083中 5.4An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS…
• CVE-2021-42082高 7.8Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qsto…
• CVE-2021-42081高 7.2An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storag…
• CVE-2021-42079中 4.9An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. …