CVE-2021-42083

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*
OR cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

22 Sep 2025, 07:15

Type Values Removed Values Added
Summary (en) An authenticated attacker is able to create alerts that trigger a stored XSS attack. (en) An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.

21 Nov 2024, 06:27

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.4
v2 : unknown
v3 : 8.7
References
  • () https://www.divd.nl/DIVD-2021-00020 -
References () https://csirt.divd.nl/CVE-2021-42083 - Third Party Advisory () https://csirt.divd.nl/CVE-2021-42083 - Third Party Advisory
References () https://www.osnexus.com/products/software-defined-storage - Product () https://www.osnexus.com/products/software-defined-storage - Product
References () https://www.wbsec.nl/osnexus - Third Party Advisory () https://www.wbsec.nl/osnexus - Third Party Advisory

16 Oct 2024, 12:15

Type Values Removed Values Added
References
  • {'url': 'https://www.divd.nl/DIVD-2021-00020', 'tags': ['Broken Link'], 'source': 'csirt@divd.nl'}
  • () https://csirt.divd.nl/DIVD-2021-00020/ -

02 Jan 2024, 19:15

Type Values Removed Values Added
Summary An authenticated attacker is able to create alerts that trigger a stored XSS attack.  An authenticated attacker is able to create alerts that trigger a stored XSS attack.

13 Jul 2023, 23:11

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.4
CWE CWE-79
References (MISC) https://csirt.divd.nl/CVE-2021-42083 - (MISC) https://csirt.divd.nl/CVE-2021-42083 - Third Party Advisory
References (MISC) https://www.divd.nl/DIVD-2021-00020 - (MISC) https://www.divd.nl/DIVD-2021-00020 - Broken Link
References (MISC) https://www.wbsec.nl/osnexus - (MISC) https://www.wbsec.nl/osnexus - Third Party Advisory
References (MISC) https://www.osnexus.com/products/software-defined-storage - (MISC) https://www.osnexus.com/products/software-defined-storage - Product

10 Jul 2023, 16:27

Type Values Removed Values Added
New CVE

Information

Published : 2023-07-10 16:15

Updated : 2025-09-22 07:15


NVD link : CVE-2021-42083

Mitre link : CVE-2021-42083

CVE.ORG link : CVE-2021-42083


JSON object : View

Products Affected

linux

  • linux_kernel

microsoft

  • windows

osnexus

  • quantastor
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')