Lucene search

TwcertCVE-2021-37216

HistoryAug 02, 2021 - 12:15 p.m.

CVE-2021-37216

2021-08-0212:15:08

CWE-79

twcert

web.nvd.nist.gov

qsan

storage manager

cve-2021-37216

xss

remote attack

security vulnerability

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

46.0%

JSON

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

Affected configurations

Nvd

Node

qsanxn8024r_firmwareMatch3.1.5

AND

qsanxn8024rMatch-

Node

qsanxn8008t_firmwareMatch3.3.2

AND

qsanxn8008tMatch-

VendorProductVersionCPE
qsanxn8024r_firmware3.1.5cpe:2.3:o:qsan:xn8024r_firmware:3.1.5:*:*:*:*:*:*:*
qsanxn8024r-cpe:2.3:h:qsan:xn8024r:-:*:*:*:*:*:*:*
qsanxn8008t_firmware3.3.2cpe:2.3:o:qsan:xn8008t_firmware:3.3.2:*:*:*:*:*:*:*
qsanxn8008t-cpe:2.3:h:qsan:xn8008t:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qsan	xn8024r_firmware	3.1.5	cpe:2.3:o:qsan:xn8024r_firmware:3.1.5:::::::*
qsan	xn8024r	-	cpe:2.3:h:qsan:xn8024r:-:::::::*
qsan	xn8008t_firmware	3.3.2	cpe:2.3:o:qsan:xn8008t_firmware:3.3.2:::::::*
qsan	xn8008t	-	cpe:2.3:h:qsan:xn8008t:-:::::::*

CNA Affected

[
  {
    "product": "Storage Manager XN8008T",
    "vendor": "QSAN",
    "versions": [
      {
        "lessThanOrEqual": "3.3.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Storage Manager XN8024R",
    "vendor": "QSAN",
    "versions": [
      {
        "lessThanOrEqual": "3.1.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

46.0%

JSON

Related for CVE-2021-37216