PT-2021-19733 · Qsan · Qsan Storage Manager

Published 2021-07-07 · Updated 2022-08-05 · CVE-2021-32508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3

Description: The issue allows remote authenticated attackers to access arbitrary files by injecting a Symbolic Link following the Url path parameter in the FileStreaming component. This enables attackers to traverse the file system and access files that would otherwise be restricted.

Recommendations: For versions prior to 3.3.3, update to version 3.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the FileStreaming component until the update can be applied. Avoid using the Url path parameter in the affected FileStreaming component until the issue is resolved.

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-61

Related Identifiers

CVE-2021-32508

Affected Products

Qsan Storage Manager

References · 5

• https://osv.dev/vulnerability/CVE-2021-32508 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32508 · Security Note
• https://twcert.org.tw/tw/cp-132-4864-94df4-1.html · Note
• https://t.me/cvenotify/18007 · Telegram Post
• https://t.me/cvenotify/17404 · Telegram Post