CVE-2021-37216

MEDIUMNuclei

QSAN Storage Manager - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-37216 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Storage Manager XN8008T

Browse QSAN / Storage Manager XN8008T
CVE ListThrough 3.3.2affected

Storage Manager XN8024R

Browse QSAN / Storage Manager XN8024R
CVE ListThrough 3.1.5affected

Nuclei templates

1
ProjectDiscoveryMEDIUMQSAN Storage Manager <3.3.3 - Cross-Site ScriptingCVSS 6.1

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade QSAN Storage Manager to version 3.3.3 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorsdwisiswant0
Template tagscvecve2021xssqsanstoragevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:qsan:xn8024r_firmware:3.1.5:*:*:*:*:*:*:*
https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html https://nvd.nist.gov/vuln/detail/CVE-2021-37216 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2