PT-2017-19317 · Osnexus · Quantastor

Nahuel D. Sanchez · Publicado 2017-08-28 · Atualizado 2024-02-14 · CVE-2017-9979

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSNEXUS QuantaStor versions prior to 4.3.1

Description The issue allows an attacker to inject arbitrary HTML or JavaScript code as a parameter in a REST call, potentially leading to a cross-site scripting (XSS) attack. When an invalid REST call is invoked, the error response contains the previously invoked method, which is not sanitized. This lack of sanitization enables the inclusion of malicious code.

Recommendations For OSNEXUS QuantaStor versions prior to 4.3.1, update to version 4.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation. Avoid using parameters that could be used to inject malicious code in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9979

Produtos afetados

Quantastor

Referências · 6

• 🔥 http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Aug/23 · Exploit
• 🔥 https://exploit-db.com/exploits/42517 · Exploit
• 🔥 http://vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9979 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9979 · Aviso do Fabricante