CVE-2021-32510

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary directories by injecting file path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-548

Affected software

VendorProductVersions
QSANStorage Manager>= unspecified, <= 3.3.1

References

Timeline

Published
Jul 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325114.3QSAN Storage Manager through directory listing vulnerability in ViewBroserList allows remote authenticated attackers to list arbitrary direcCVE-2021-325129.8QuickInstall in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and CVE-2021-325139.8QsanTorture in QSAN Storage Manager does not filter special parameters properly that allows remote unauthenticated attackers to inject and eCVE-2021-325147.5Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the devicCVE-2021-325155.3Directory listing vulnerability in share_link in QSAN Storage Manager allows attackers to list arbitrary directories and further access credCVE-2021-325167.5Path traversal vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files. The referred vulneraCVE-2021-325177.5Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particCVE-2021-325187.5A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The refCVE-2021-325197.5Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to reCVE-2021-32527.5KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from theCVE-2021-325209.8Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissiCVE-2021-325219.8Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest
CVE-2021-32510: Medium severity, CVSS 4.3 | Vulnix