Lucene search

[email protected]NVD:CVE-2021-32508

HistoryJul 07, 2021 - 2:15 p.m.

CVE-2021-32508

2021-07-0714:15:10

CWE-59

CWE-61

[email protected]

web.nvd.nist.gov

cve-2021-32508

absolute path traversal

qsan storage manager

filestreaming

remote attackers

authenticated

arbitrary files

symbolic link

url path parameter

solved

updated version

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.2%

JSON

Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Affected configurations

Nvd

Node

qsanstorage_managerRange<3.3.3

VendorProductVersionCPE
qsanstorage_manager*cpe:2.3:a:qsan:storage_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qsan	storage_manager	*	cpe:2.3:a:qsan:storage_manager::::::::

References

www.twcert.org.tw/tw/cp-132-4864-94df4-1.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

50.2%

JSON

Related for NVD:CVE-2021-32508

cve1 prion1 cvelist1