CVE-2023-51063 is a high severity (CVSS 8.8) DOM based reflected cross-site scripting flaw in QStar Archive Solutions Release 3-0 Build 7 Patch 0, in the qnme-ajax tree_level method. The record names no fix, so ask QStar for a patched build and restrict access.
What's affected
The NVD record lists QStar Archive Solutions (Archive Storage Manager) Release 3-0, Build 7, Patch 0 as affected. The description says the DOM based reflected cross-site scripting issue sits in the component qnme-ajax with the method tree_level.
The record names no fixed release, and the only reference is a researcher write-up on GitHub that I did not load. Check with QStar for a patched build and ask for their advisory.
CVSS for this entry is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
How to check if you're exposed
Look in the product's about or system information page for the release string. A match on Release 3-0 Build 7 Patch 0 means you are in scope of the record. The XSS needs a user to open a crafted link, so also tell administrators not to follow links to the management console from email or chat.
Because the record lists no CWE-specific fix guidance, the most useful check is network reachability: can systems outside your storage administration network reach the QStar server's web service?
What to do now
- Identify QStar Archive Solutions servers and confirm the release, build and patch level.
- Ask QStar whether a build newer than Build 7 Patch 0 fixes this CVE, and apply it when available.
- Restrict network access to the QStar web interface and services to the administrators and systems that need them.
- Review the server's access logs and configuration for changes you did not make, then record the outcome.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-79 is cross-site scripting. The application places attacker-influenced content into a page without neutralizing it, so a victim's browser runs script in the context of the trusted site. The fix is to encode output for the context it lands in and to validate input where it enters.
CWE-352 is cross-site request forgery. A site trusts a request because it comes from a logged-in browser, without checking that the user meant to send it. The usual fix is an anti-forgery token that the server verifies on every state-changing request.
The record lists CWE-79 and CWE-352 together. Cross-site scripting runs script in the victim's browser, while cross-site request forgery lets a page trigger actions the user did not intend. The NVD vector requires user interaction but no privileges, and rates all three impacts high, so a successful attack on an administrator could reach a lot of the system.
For reflected issues, the practical defenses are patching and keeping administrators away from untrusted links.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Does the victim need to click something?
Yes. The vector requires user interaction.
Is a fixed version listed?
No. The record names none. Contact QStar.
Sources
Last reviewed: 19 October 2026.
