CVE-2021-37216mediumCWE-79

CVE-2021-37216: medium-severity vulnerability in QSAN Storage Manager XN8008T

QSAN Storage Manager - Reflected Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Storage Manager XN8008T+ Monitor Storage Manager XN8024R

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 6.1epss 3.2%
In short

QSAN Storage Manager's header page allows attackers to inject malicious JavaScript code that runs in users' browsers without requiring login. This can trick users into revealing sensitive information or having their data modified.

Technical detail

Reflected XSS vulnerability in QSAN Storage Manager header page parameters due to insufficient input validation of special characters. Unauthenticated remote attackers can craft malicious URLs containing JavaScript payloads that execute in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized data modification.

Summary generated and translated by AI from the official description.
QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
QSAN · Storage Manager XN8008TQSAN · Storage Manager XN8024R