PT-2017-19316 · Osnexus · Quantastor

Nahuel D. Sanchez · Publicado 2017-08-28 · Atualizado 2024-02-14 · CVE-2017-9978

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OSNEXUS QuantaStor versions prior to 4.3.1

Description A flaw was found in the error message sent as a response for non-existent users on the system. This could allow an attacker to enumerate valid accounts by searching for common usernames.

Recommendations For versions prior to 4.3.1, update to version 4.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the error message response to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-9978

Produtos afetados

Quantastor

Referências · 6

• 🔥 http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Aug/23 · Exploit
• 🔥 https://exploit-db.com/exploits/42517 · Exploit
• 🔥 http://vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9978 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9978 · Aviso do Fabricante