Description
QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QSAN | Storage Manager XN8008T | unspecified – ≤ 3.3.2 | — |
| QSAN | Storage Manager XN8024R | unspecified – ≤ 3.1.5 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- QSAN Storage Manager <3.3.3 - Cross-Site Scripting http/cves/2021/CVE-2021-37216.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.