CVE-2021-42080 - Vulnerability Details - OpenCVE

An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Osnexus	Quantastor

Configuration 1 [-]

cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://csirt.divd.nl/CVE-2021-42080
https://csirt.divd.nl/DIVD-2021-00020/
https://www.divd.nl/DIVD-2021-00020
https://www.osnexus.com/products/software-defined-storage
https://www.wbsec.nl/osnexus

History

Mon, 22 Sep 2025 06:45:00 +0000

Type	Values Removed	Values Added
Description	An attacker is able to launch a Reflected XSS attack using a crafted URL.	An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>

Fri, 22 Nov 2024 12:00:00 +0000

Type	Values Removed	Values Added
References		https://www.divd.nl/DIVD-2021-00020

Mon, 21 Oct 2024 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 16 Oct 2024 12:30:00 +0000

Type	Values Removed	Values Added
References	https://www.divd.nl/DIVD-2021-00020

Wed, 16 Oct 2024 12:00:00 +0000

Type	Values Removed	Values Added
References		https://csirt.divd.nl/DIVD-2021-00020/
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`	cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: DIVD

Published: 2023-07-10T06:29:48.166Z

Updated: 2025-09-22T06:40:04.494Z

Reserved: 2021-10-07T17:12:57.677Z

Link: CVE-2021-42080

Vulnrichment

Updated: 2024-08-04T03:22:25.845Z

NVD

Status : Modified

Published: 2023-07-10T16:15:47.530

Modified: 2025-09-22T07:15:39.393

Link: CVE-2021-42080

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-42080", "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "state": "PUBLISHED", "assignerShortName": "DIVD", "dateReserved": "2021-10-07T17:12:57.677Z", "datePublished": "2023-07-10T06:29:48.166Z", "dateUpdated": "2025-09-22T06:40:04.494Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "QuantaStor", "vendor": "OSNEXUS", "versions": [{"lessThan": "6.0.0.355", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wietse Boonstra (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Frank Breedijk (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Pasman (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Gevers (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Max van der Horst (DIVD)"}, {"lang": "en", "type": "analyst", "value": "C\u00e9listine Oosting (DIVD)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An attacker is able to launch a Reflected XSS attack using a crafted URL.<br><br>POC:<br><br>Visit the following URL<br><div><div><div><div><div><div><div><pre><div>https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)></div></pre></div></div></div></div></div></div></div>"}], "value": "An attacker is able to launch a Reflected XSS attack using a crafted URL.\n\nPOC:\n\nVisit the following URL\nhttps://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "shortName": "DIVD", "dateUpdated": "2025-09-22T06:40:04.494Z"}, "references": [{"tags": ["third-party-advisory", "technical-description"], "url": "https://www.wbsec.nl/osnexus"}, {"tags": ["third-party-advisory"], "url": "https://csirt.divd.nl/DIVD-2021-00020/"}, {"tags": ["product"], "url": "https://www.osnexus.com/products/software-defined-storage"}, {"tags": ["third-party-advisory", "technical-description", "exploit"], "url": "https://csirt.divd.nl/CVE-2021-42080"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to the latest version of OSNEXUS QuantaStor."}], "value": "Upgrade to the latest version of OSNEXUS QuantaStor."}], "source": {"discovery": "UNKNOWN"}, "title": "Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:22:25.845Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wbsec.nl/osnexus", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.divd.nl/DIVD-2021-00020", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.osnexus.com/products/software-defined-storage", "tags": ["product", "x_transferred"]}, {"url": "https://csirt.divd.nl/CVE-2021-42080", "tags": ["third-party-advisory", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-21T21:06:56.590163Z", "id": "CVE-2021-42080", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T21:10:56.435Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wbsec.nl/osnexus", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.divd.nl/DIVD-2021-00020", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.osnexus.com/products/software-defined-storage", "tags": ["product", "x_transferred"]}, {"url": "https://csirt.divd.nl/CVE-2021-42080", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:22:25.845Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-42080", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T21:06:56.590163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T21:08:22.203Z"}}], "cna": {"title": "Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Wietse Boonstra (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Frank Breedijk (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Pasman (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Gevers (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Max van der Horst (DIVD)"}, {"lang": "en", "type": "analyst", "value": "C\u00e9listine Oosting (DIVD)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OSNEXUS", "product": "QuantaStor", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.0.355", "versionType": "semver"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Upgrade to the latest version of OSNEXUS QuantaStor.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to the latest version of OSNEXUS QuantaStor.", "base64": false}]}], "references": [{"url": "https://www.wbsec.nl/osnexus", "tags": ["third-party-advisory", "technical-description"]}, {"url": "https://csirt.divd.nl/DIVD-2021-00020/", "tags": ["third-party-advisory"]}, {"url": "https://www.osnexus.com/products/software-defined-storage", "tags": ["product"]}, {"url": "https://csirt.divd.nl/CVE-2021-42080", "tags": ["third-party-advisory", "technical-description", "exploit"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An attacker is able to launch a Reflected XSS attack using a crafted URL.\n\nPOC:\n\nVisit the following URL\nhttps://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>", "supportingMedia": [{"type": "text/html", "value": "An attacker is able to launch a Reflected XSS attack using a crafted URL.<br><br>POC:<br><br>Visit the following URL<br><div><div><div><div><div><div><div><pre><div>https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)></div></pre></div></div></div></div></div></div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "shortName": "DIVD", "dateUpdated": "2025-09-22T06:40:04.494Z"}}}, "cveMetadata": {"cveId": "CVE-2021-42080", "state": "PUBLISHED", "dateUpdated": "2025-09-22T06:40:04.494Z", "dateReserved": "2021-10-07T17:12:57.677Z", "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "datePublished": "2023-07-10T06:29:48.166Z", "assignerShortName": "DIVD"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E101217-36C7-4C28-8C61-7744481D2D0E", "versionEndExcluding": "6.0.0.355", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker is able to launch a Reflected XSS attack using a crafted URL.\n\nPOC:\n\nVisit the following URL\nhttps://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>"}], "id": "CVE-2021-42080", "lastModified": "2025-09-22T07:15:39.393", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "csirt@divd.nl", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-10T16:15:47.530", "references": [{"source": "csirt@divd.nl", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/CVE-2021-42080"}, {"source": "csirt@divd.nl", "url": "https://csirt.divd.nl/DIVD-2021-00020/"}, {"source": "csirt@divd.nl", "tags": ["Product"], "url": "https://www.osnexus.com/products/software-defined-storage"}, {"source": "csirt@divd.nl", "tags": ["Third Party Advisory"], "url": "https://www.wbsec.nl/osnexus"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/CVE-2021-42080"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.divd.nl/DIVD-2021-00020"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.osnexus.com/products/software-defined-storage"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wbsec.nl/osnexus"}], "sourceIdentifier": "csirt@divd.nl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "csirt@divd.nl", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}