CVE-2021-32517

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper access control vulnerability in share_link in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
QSANStorage Manager>= unspecified, <= 3.3.1

References

Timeline

Published
Jul 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325187.5A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files. The refCVE-2021-325197.5Use of password hash with insufficient computational effort vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to reCVE-2021-32527.5KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from theCVE-2021-325209.8Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissiCVE-2021-325219.8Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest CVE-2021-325229.8Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discCVE-2021-325237.2Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitraCVE-2021-325247.2Command injection vulnerability in QSAN Storage Manager allows remote privileged users to execute arbitrary commands. Suggest contacting witCVE-2021-325257.2The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the admiCVE-2021-325266.5Incorrect permission assignment for critical resource vulnerability in QSAN Storage Manager allows authenticated remote attackers to access CVE-2021-325277.5Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting fileCVE-2021-325285.3Observable behavioral discrepancy vulnerability in QSAN Storage Manager allows remote attackers to obtain the system information without per
CVE-2021-32517: High severity, CVSS 7.5 | Vulnix