Lucene search

TwcertCVELIST:CVE-2021-32506

HistoryJul 07, 2021 - 2:11 p.m.

CVE-2021-32506 QSAN Storage Manager - Absolute Path Traversal via GetImage function

2021-07-0714:11:39

CWE-36

twcert

www.cve.org

path traversal

qsan storage

remote attackers

absolute path

getimage function

cve-2021-32506

updated version

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

54.8%

JSON

Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3 .

CNA Affected

[
  {
    "product": "Storage Manager",
    "vendor": "QSAN",
    "versions": [
      {
        "lessThanOrEqual": "3.3.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4862-f8b86-1.html

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

54.8%

JSON

Related for CVELIST:CVE-2021-32506