CVE-2021-32507: medium-severity vulnerability in QSAN Storage Manager
QSAN Storage Manager - Absolute Path Traversal via FileDownload function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in QSAN Storage Manager's file download function allows authenticated users to download any file from the server by manipulating the file path parameter, potentially exposing sensitive data like configuration files or credentials.
An absolute path traversal vulnerability in the FileDownload endpoint permits authenticated attackers to bypass directory restrictions and retrieve arbitrary files by crafting malicious Url path parameters. The vulnerability requires prior authentication but enables unauthorized file access with confidentiality impact; remediated in v3.3.3.
In the same product, most dangerous first.