title: QSAN Storage Manager - Reflected Cross-Site Scripting
description: QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Storage Manager XN8008T
vendor: QSAN
versions:
lessThanOrEqual: 3.3.2, status: affected, version: unspecified, versionType: custom
}
{
product: Storage Manager XN8024R
vendor: QSAN
versions:
lessThanOrEqual: 3.1.5, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
solutions: Update QSAN Storage Manager to version 3.3.3