Vulnerability · Published Jul 7, 2021 · Assigned by twcert
CVE-2021-32507QSAN Storage Manager - Absolute Path Traversal via FileDownload function
Medium 6.5
In plain English
A medium-severity security flaw in Storage Manager from QSAN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.3%top 29.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QSAN | Storage Manager | unspecified – through 3.3.1 |
Weakness: CWE-36 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-4863-57d4a-1.html x_refsource_MISC