CVE-2021-42083
Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
POC
-
go to the alert manager
-
open the ITSM tab
-
add a webhook with the URL/service token value
' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)
-
click add
-
click apply
-
create a test alert
-
The test alert will run the command
“id | tee /tmp/ttttttddddssss” as root.
- after the test alert inspect
/tmp/ttttttddddssss it'll contain the ids of the root user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
POC
-
go to the alert manager
-
open the ITSM tab
-
add a webhook with the URL/service token value
' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)
-
click add
-
click apply
-
create a test alert
-
The test alert will run the command
“id | tee /tmp/ttttttddddssss” as root.
- after the test alert inspect
/tmp/ttttttddddssss it'll contain the ids of the root user.
- Record
CVE-2021-42083- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-29069
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
POC
-
go to the alert manager
-
open the ITSM tab
-
add a webhook with the URL/service token value
' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)
-
click add
-
click apply
-
create a test alert
-
The test alert will run the command
“id | tee /tmp/ttttttddddssss” as root.
- after the test alert inspect
/tmp/ttttttddddssss it'll contain the ids of the root user.
- Record
EUVD-2021-29069- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9c8q-55w7-h67h
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
- Record
GHSA-9c8q-55w7-h67h- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
POC
-
go to the alert manager
-
open the ITSM tab
-
add a webhook with the URL/service token value
' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)
-
click add
-
click apply
-
create a test alert
-
The test alert will run the command
“id | tee /tmp/ttttttddddssss” as root.
- after the test alert inspect
/tmp/ttttttddddssss it'll contain the ids of the root user.
- Record
CVE-2021-42083- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-42083 is a high vulnerability (CVSS 8.7) in Osnexus Quantastor, published July 10, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. No source names a fixed version.