CVE-2021-4406

Katalog CVE

CVSS 7.2 · High EPSS 0,96%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada osnexus quantastor. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.

Rincian

Terbit di NVD

10 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://csirt.divd.nl/CVE-2021-4406 advisory pihak ketiga
• https://csirt.divd.nl/DIVD-2021-00020/
• https://www.osnexus.com/products/software-defined-storage product
• https://www.divd.nl/DIVD-2021-00020
• https://csirt.divd.nl/cves/CVE-2021-4406/