CVE-2021-32506

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Absolute Path Traversal vulnerability in GetImage in QSAN Storage Manager allows remote authenticated attackers download arbitrary files via the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3 .

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-36CWE-22

Affected software

VendorProductVersions
QSANStorage Manager>= unspecified, <= 3.3.1

References

Timeline

Published
Jul 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325076.5Absolute Path Traversal vulnerability in FileDownload in QSAN Storage Manager allows remote authenticated attackers download arbitrary filesCVE-2021-325086.5Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files CVE-2021-325096.5Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files byCVE-2021-325104.3QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary dCVE-2021-325114.3QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary direcCVE-2021-325129.8QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and CVE-2021-325139.8QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and eCVE-2021-325147.5Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the devicCVE-2021-325155.3Directory listing vulnerability in share_link in QSAN Storage Manager allows attackers to list arbitrary directories and further access credCVE-2021-325167.5Path traversal vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulneraCVE-2021-325177.5Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particCVE-2021-325187.5A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The ref
CVE-2021-32506: Medium severity, CVSS 6.5 | Vulnix