Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Quali CloudShell lets attackers run malicious web scripts

CVE-2017-9767 · published 9 years ago
Summary

If a user can log into Quali CloudShell version 7 or earlier, they can place harmful code into fields such as Name or Description. This code can then run in other users' browsers, potentially stealing data or changing what they see. Upgrade to version 8 or later, or apply the vendor's patches, to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
quali cloudshell <= 7.1.0.6508
cpe:2.3:a:quali:cloudshell:*:*:*:*:*:*:*:*
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Name or (2) Description paramete...
Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Name or (2) Description parameter to RM/Reservation/ReserveNew; the (3) Description parameter to RM/Topology/Update; the (4) Name, (5) Description, (6) ExecutionBatches[0].Name, (7) ExecutionBatches[0].Description, or (8) Labels parameter to SnQ/JobTemplate/Edit; or (9) Alias or (10) Description parameter to RM/AbstractTemplate/AddOrUpdateAbstractTemplate.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Aug 2017
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-9767 · NVD
Track software like this
Free during beta