CVE-2021-32518highCWE-61

CVE-2021-32518: high-severity vulnerability in QSAN Storage Manager

QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following

Published · Updated

Follow this CVE+ Monitor Storage Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.7%
In short

QSAN Storage Manager has a flaw that allows attackers to create symbolic links to trick the system into accessing files they shouldn't be able to reach. This could expose sensitive data stored on the server.

Technical detail

The share_link function in QSAN Storage Manager is vulnerable to symlink following attacks, allowing remote attackers to create symbolic links that redirect file access to arbitrary locations on the filesystem. This CWE-61 vulnerability enables unauthorized file disclosure without authentication requirements, resolved in version 3.3.3.

Summary generated and translated by AI from the official description.
A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
QSAN · Storage Manager
Related CVEs — QSAN Storage Manager

In the same product, most dangerous first.

CVE-2021-32513CRITICALQSAN Storage Manager - Command Injection Following via QsanTorture functionEPSS 2.1%CVE-2021-32512CRITICALQSAN Storage Manager - Command Injection Following via QuickInstall functionEPSS 2.1%CVE-2021-32527HIGHQSAN Storage Manager - Path Traversal-2EPSS 1.7%CVE-2021-32524CRITICALQSAN Storage Manager - Command Injection-3EPSS 1.7%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-32516HIGHQSAN Storage Manager - Path TraversalEPSS 1.7%