CVE-2021-32508mediumCWE-61

CVE-2021-32508: medium-severity vulnerability in QSAN Storage Manager

QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming function

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.3%
exploitation probability
1.3%top 30% of all CVEs
observed exploitation
nono source reports it
In short

A flaw in QSAN Storage Manager allows authenticated users to read any file on the system by manipulating file paths with symbolic links. An attacker who has login access can exploit this to view sensitive files they shouldn't have permission to access.

Technical detail

Absolute path traversal vulnerability in the FileStreaming function allows authenticated remote attackers to bypass access controls via symbolic link injection through the URL path parameter. The vulnerability requires valid authentication credentials and enables arbitrary file disclosure on the affected system.

Summary generated and translated by AI from the official description.
Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
QSAN · Storage Manager
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32513CRITICALQSAN Storage Manager - Command Injection Following via QsanTorture functionEPSS 2.1%CVE-2021-32512CRITICALQSAN Storage Manager - Command Injection Following via QuickInstall functionEPSS 2.1%CVE-2021-32527HIGHQSAN Storage Manager - Path Traversal-2EPSS 1.7%CVE-2021-32524CRITICALQSAN Storage Manager - Command Injection-3EPSS 1.7%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-32518HIGHQSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingEPSS 1.7%
References
https://www.twcert.org.tw/tw/cp-132-4864-94df4-1.html