PatchTheCVEquantastor vulnerabilities and fixes
Recent CVEs affecting quantastor, with upgrade or downgrade steps. 6 tracked.
quantastor has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2023-07-10. Highest priority: CVE-2021-42081 (score 49/100).
- CVE-2021-4406 CRITICAL 9.1 UPGRADE An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the ale
- CVE-2021-42083 HIGH 8.7 UPGRADE An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the ale
- CVE-2021-42082 HIGH 7.8 UPGRADE Local users are able to execute scripts under root privileges. POC On the local host run the following comma
- CVE-2021-42081 CRITICAL 9.1 UPGRADE An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http:
- CVE-2021-42080 HIGH 7.4 UPGRADE An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https
- CVE-2021-42079 MEDIUM 6.2 UPGRADE An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack
FAQ
How do I fix quantastor vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is quantastor being exploited right now?
None of the tracked quantastor CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which quantastor CVE should I patch first?
CVE-2021-42081 currently ranks highest (49/100): An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http:.