Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)

Full Disclosure ()2
Read at seclists.org
Part of a story covered by 2 sources0day Rubbish Research Team discloses two CVSS 8.8 command injection flaws: QuantaStor 6.8.3.018 alert-mail smtpPassword injection and persistent OP5 Monitor 9.20 injection despite…Merged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

QuantaStor 6.8.3.018 has a CVSS 8.8 command injection in its alert-mail command, exploitable via the smtpPassword field.

0day Rubbish Research Team disclosed a command injection (CWE-78) in QuantaStor 6.8.3.018's alert-mail command, reachable through the smtpPassword field. The flaw scores CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or evidence of active exploitation is mentioned in the disclosure.

Key facts
  • Command injection (CWE-78) in the QuantaStor alert-mail command via the smtpPassword field
  • CVSS 8.8 network vector with low-privilege requirement and high C/I/A impact
  • Disclosed publicly as a 0day without mention of active exploitation
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
command-injectioncwe-78quantastorstorage

From the original article

Posted by disclosure via Fulldisclosure on Sep 08 TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] QuantaStor 6. 8. 3.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.