On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html | Exploit Third Party Advisory VDB Entry |
http://seclists.org/fulldisclosure/2017/Aug/23 | Exploit Mailing List Third Party Advisory |
http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt | Exploit Third Party Advisory URL Repurposed |
https://www.exploit-db.com/exploits/42517/ | Exploit Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2017-08-28T19:00:00
Updated: 2017-08-28T18:57:01
Reserved: 2017-06-26T00:00:00
Link: CVE-2017-9979
JSON object: View
NVD Information
Status : Analyzed
Published: 2017-08-28T19:29:01.497
Modified: 2024-02-14T01:17:43.863
Link: CVE-2017-9979
JSON object: View
Redhat Information
No data.
CWE