Justine Osborne

**Name of the Vulnerable Software and Affected Versions** StorNext RYO versions prior to 7.2.4 StorNext Xcellis Workflow Director versions prior to 7.2.4 ActiveScale Cold Storage versions prior to 7.2.4 Quantum StorNext Web GUI API versions prior to 7.2.4 **Description** The issue allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. **Recommendations** For StorNext RYO versions prior to 7.2.4, update to version 7.2.4 or later. For StorNext Xcellis Workflow Director versions prior to 7.2.4, update to version 7.2.4 or later. For ActiveScale Cold Storage versions prior to 7.2.4, update to version 7.2.4 or later. For Quantum StorNext Web GUI API versions prior to 7.2.4, update to version 7.2.4 or later. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** StorNext RYO versions prior to 7.2.4 StorNext Xcellis Workflow Director versions prior to 7.2.4 ActiveScale Cold Storage versions prior to 7.2.4 **Description** The issue allows access to internal configuration and unauthorized modification of software configuration parameters via undocumented user credentials. **Recommendations** For StorNext RYO versions prior to 7.2.4, update to version 7.2.4 or later. For StorNext Xcellis Workflow Director versions prior to 7.2.4, update to version 7.2.4 or later. For ActiveScale Cold Storage versions prior to 7.2.4, update to version 7.2.4 or later.

**Name of the Vulnerable Software and Affected Versions** Rundeck versions prior to 3.2.6 **Description** The issue allows authenticated users to craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher. An authenticated user could craft a request to view Executions and download execution logs without access to `read` or `view` the associated Job, or ad-hoc resource. Some authenticated API requests were not correctly checking appropriate authorization levels. **Recommendations** Upgrade to Rundeck version 3.2.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and intellectual property exposed in Rundeck execution output and job data until the patch is applied. Restrict access to the `read` and `view` functions for Jobs and ad-hoc resources to minimize the risk of exploitation. Avoid using the `run` access to the Job without proper authorization until the issue is resolved.