CVE-2021-4406
Assigner: DIVD
Published: 2023-07-10T06:29:48.698Z
State: PUBLISHED
title: Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others
problemTypes: descriptions: cweId: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: CWE
affected: vendor: OSNEXUS
product: QuantaStor
versions: status: affected
version: 0
lessThanOrEqual: 6.0.0.355
versionType: semver
defaultStatus: unknown
descriptions: value: An administrator is able to execute commands as root via the alerts management dialog
supportingMedia: type: text/html
base64: no
value: An administrator is able to execute commands as root via the alerts management dialog
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
solutions: value: Upgrade to the latest version of OSNEXUS QuantaStor and hope it is fixed
supportingMedia: type: text/html
base64: no
value: Upgrade to the latest version of OSNEXUS QuantaStor and hope it is fixed
credits: value: Wietse Boonstra
user: 00000000-0000-4000-9000-000000000000
type: finder
source: discovery: INTERNAL
x_generator: engine: Vulnogram 0.1.0-dev