CVEvulnerability
CVE-2017-9979
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-08-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
Affected configurations
• osnexus quantastor (<= 4.3.0)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Aug/23 Exploit, Mailing List, Third Party Advisory
- http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt Exploit, Third Party Advisory, URL Repurposed
- https://www.exploit-db.com/exploits/42517/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Aug/23 Exploit, Mailing List, Third Party Advisory
- http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt Exploit, Third Party Advisory, URL Repurposed
- https://www.exploit-db.com/exploits/42517/ Exploit, Third Party Advisory, VDB Entry