CVE-2021-32527: high-severity vulnerability in QSAN Storage Manager
QSAN Storage Manager - Path Traversal-2
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in QSAN Storage Manager allows anyone on the internet to download any file from the server by manipulating the file path in the download function, without needing to log in.
This path traversal vulnerability (CWE-22) in the download function accepts unsanitized file path input from unauthenticated remote attackers, enabling arbitrary file disclosure. The attack vector requires only network access and a crafted request with traversal sequences (e.g., ../) to access files outside the intended directory, compromising confidentiality of sensitive data stored on the server.
In the same product, most dangerous first.