Back to Database
Status published
High
CVE-2021-42080
Reflected XSS vulnerability in OSNEXUS QuantaStor before 6.0.0.355
Vulnerability Description
An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://<IPADDRESS>:8153/qstorapi/echo?inputMessage=<img%20src=x%20onerror=alert(document.cookie)>
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-42080
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Wietse Boonstra (DIVD)
- Frank Breedijk (DIVD)
- Victor Pasman (DIVD)
- Victor Gevers (DIVD)
- Max van der Horst (DIVD)
- Célistine Oosting (DIVD)
References
More from OSNEXUS
View All →CVE-2021-4406
Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others
Critical
9.1
CVE-2021-42083
Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335
High
8.7
CVE-2021-42082
Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355
High
7.8
CVE-2021-42081
Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355
Critical
9.1
CVE-2021-42079
SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355
Medium
6.2
Affected Vendor
OSNEXUS
View all reports →Affected Software
QuantaStor
Vulnerable Versions:
0
Timeline
Official Publish:
July 10th, 2023
Last Modified:
September 22nd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N