CVE-2017-9979

On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.

• CWE-79

• http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Aug/23Exploit, Mailing List, Third Party Advisory
• http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txtExploit, Third Party Advisory, URL Repurposed
• https://www.exploit-db.com/exploits/42517/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Aug/23Exploit, Mailing List, Third Party Advisory
• http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txtExploit, Third Party Advisory, URL Repurposed
• https://www.exploit-db.com/exploits/42517/Exploit, Third Party Advisory, VDB Entry

Published

Aug 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9972Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-9973Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-9974Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-9975Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-9977AVG AntiVirus for MacOS with scan engine before 4668 might a…
• CVE-2017-9978On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1,…
• CVE-2017-9980In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-athe…
• CVE-2017-9982TeamSpeak Client 3.0.19 allows remote attackers to cause a d…
• CVE-2017-9984The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinna…7.8
• CVE-2017-9985The snd_msndmidi_input_read function in sound/isa/msnd/msnd_…7.8
• CVE-2017-9986The intr function in sound/oss/msnd_pinnacle.c in the Linux …
• CVE-2017-9987There is a heap-based buffer overflow in the function hpel_m…