CVE-2017-9979: XSS
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9979?
CVE-2017-9979 is classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2017-9979?
To fix CVE-2017-9979, upgrade OSNEXUS QuantaStor to version 4.3.1 or later.
What type of vulnerability is CVE-2017-9979?
CVE-2017-9979 is an information disclosure vulnerability caused by unsanitized error responses.
Which versions of OSNEXUS QuantaStor are affected by CVE-2017-9979?
CVE-2017-9979 affects OSNEXUS QuantaStor versions prior to 4.3.1.
Can CVE-2017-9979 be exploited remotely?
Yes, CVE-2017-9979 can be exploited remotely by an attacker leveraging the error response.