CVE-2017-9979

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method…

published August 28, 2017

CVSS
—
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02559 · 84.9th percentile
Published
2017-08-28T19:00Z
EPSS history
Timeline
  • 28 AUG 19:00Z
    On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method…
    cvelistv5