CVE-2021-37216: QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected…

PriorityP338medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EXPLOIT

EPSS

3.19%

86.5th percentile

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
qsan	storage_manager_xn8008t	unspecified – 3.3.2	—
qsan	storage_manager_xn8024r	unspecified – 3.1.5	—
qsan	xn8008t_firmware	—	—
qsan	xn8024r_firmware	—	—

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.