CVE-2021-4406

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-4406
An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://csirt.divd.nl/CVE-2021-4406 Third Party Advisory
https://csirt.divd.nl/DIVD-2021-00020/
https://www.osnexus.com/products/software-defined-storage Product
https://csirt.divd.nl/CVE-2021-4406 Third Party Advisory
https://www.divd.nl/DIVD-2021-00020
https://www.osnexus.com/products/software-defined-storage Product
https://csirt.divd.nl/cves/CVE-2021-4406/
Configurations

Configuration 1 (hide)

cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*
History

24 Sep 2025, 14:15

Type Values Removed Values Added
References
  • () https://csirt.divd.nl/cves/CVE-2021-4406/ -

22 Sep 2025, 07:15

Type Values Removed Values Added
Summary (en) An administrator is able to execute commands as root via the alerts management dialog (en) An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.

21 Nov 2024, 06:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.2 		v2 : unknown
v3 : 9.1
References
  • () https://www.divd.nl/DIVD-2021-00020 -
References () https://csirt.divd.nl/CVE-2021-4406 - Third Party Advisory () https://csirt.divd.nl/CVE-2021-4406 - Third Party Advisory
References () https://www.osnexus.com/products/software-defined-storage - Product () https://www.osnexus.com/products/software-defined-storage - Product

16 Oct 2024, 12:15

Type Values Removed Values Added
References
  • {'url': 'https://www.divd.nl/DIVD-2021-00020', 'tags': ['Broken Link'], 'source': 'csirt@divd.nl'}
  • () https://csirt.divd.nl/DIVD-2021-00020/ -

13 Jul 2023, 18:52

Type Values Removed Values Added
CWE CWE-77
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
CPE cpe:2.3:a:osnexus:quantastor:*:*:*:*:*:*:*:*
References (MISC) https://www.osnexus.com/products/software-defined-storage - (MISC) https://www.osnexus.com/products/software-defined-storage - Product
References (MISC) https://csirt.divd.nl/CVE-2021-4406 - (MISC) https://csirt.divd.nl/CVE-2021-4406 - Third Party Advisory
References (MISC) https://www.divd.nl/DIVD-2021-00020 - (MISC) https://www.divd.nl/DIVD-2021-00020 - Broken Link

10 Jul 2023, 16:27

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-10 16:15

Updated : 2025-09-24 14:15

NVD link : CVE-2021-4406

Mitre link : CVE-2021-4406

CVE.ORG link : CVE-2021-4406

JSON object : View

Products Affected

osnexus

  • quantastor
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')