CVE-2021-32509mediumCWE-61

CVE-2021-32509: medium-severity vulnerability in QSAN Storage Manager

QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc function

Published · Updated

Follow this CVE+ Monitor Storage Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.3%
In short

QSAN Storage Manager has a flaw where authenticated users can access files they shouldn't by manipulating symbolic links through a URL parameter. This allows attackers to read sensitive files on the system.

Technical detail

An absolute path traversal vulnerability exists in the FileviewDoc function of QSAN Storage Manager, exploitable by authenticated attackers who inject symbolic link paths via the Url parameter. The vulnerability enables unauthorized file access, bypassing intended access controls. Fixed in v3.3.3.

Summary generated and translated by AI from the official description.
Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
QSAN · Storage Manager
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32513CRITICALQSAN Storage Manager - Command Injection Following via QsanTorture functionEPSS 2.1%CVE-2021-32512CRITICALQSAN Storage Manager - Command Injection Following via QuickInstall functionEPSS 2.1%CVE-2021-32527HIGHQSAN Storage Manager - Path Traversal-2EPSS 1.7%CVE-2021-32524CRITICALQSAN Storage Manager - Command Injection-3EPSS 1.7%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-32518HIGHQSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingEPSS 1.7%