Vulnerability · Published Aug 2, 2021 · Assigned by twcert
CVE-2021-37216QSAN Storage Manager - Reflected Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site scripting in Storage Manager XN8008T from QSAN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)3.2%top 12.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QSAN | Storage Manager XN8008T | unspecified – through 3.3.2 |
| QSAN | Storage Manager XN8024R | unspecified – through 3.1.5 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html x_refsource_MISC