CVE-2021-42081

概要

参考情報

• csirt.divd.nl/CVE-2021-42081 · Third Party Advisory
• csirt.divd.nl/DIVD-2021-00020
• osnexus.com/products/software-defined-storage · Product
• wbsec.nl/osnexus · Third Party Advisory
• divd.nl/DIVD-2021-00020

quantastor のその他の脆弱性

• CVE-2021-4406高 7.2An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS…
• CVE-2021-42083中 5.4An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS…
• CVE-2021-42082高 7.8Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qsto…
• CVE-2021-42080高 7.4An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/e…
• CVE-2021-42079中 4.9An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. …