CVE-2021-32508

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-61CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325096.5Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files byCVE-2021-325104.3QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary dCVE-2021-325114.3QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary direcCVE-2021-325129.8QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and CVE-2021-325139.8QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and eCVE-2021-325147.5Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the devicCVE-2021-325155.3Directory listing vulnerability in share_link in QSAN Storage Manager allows attackers to list arbitrary directories and further access credCVE-2021-325167.5Path traversal vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulneraCVE-2021-325177.5Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particCVE-2021-325187.5A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The refCVE-2021-325197.5Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to reCVE-2021-32527.5KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the